CVE-2026-53839

The record

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

Affected packages

Related vulnerabilities

• CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a… CWE-1023
• CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized… CWE-1023
• CVE-2026-54713 CakePHP Queue is a queue-interop compatible queueing library. CWE-1023
• CVE-2026-53859 OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers… CWE-1023
• CVE-2026-7473 On affected platforms running Arista EOS where a tunnel decapsulation configuration—such… CWE-1023
• CVE-2026-48587 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. CWE-1023
• CVE-2026-4748 A regression in the way hashes were calculated caused rules containing the address range… CWE-1023
• GHSA-5jx8-q4cp-rhh6 jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce… CWE-1023