CVE-2026-53833
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
OpenClaw before version 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy.
Risk Assessment
This vulnerability may lead to unauthorized changes in configuration, threatening system integrity and potentially allowing attackers to take control of QQBot functionalities.
Recommendation
It is recommended to update OpenClaw to version 2026.4.29 or later and review authorization policies to minimize risk.
Original NVD description (English source)
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.