CVE-2026-53834
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An authorization bypass vulnerability in OpenClaw before 2026.4.27 allows authenticated senders to skip allowFrom policy checks in QQBot pre-dispatch slash commands. Attackers can invoke slash commands before access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.
Risk Assessment
The risk is that blocked senders may execute slash commands, potentially leading to unauthorized actions based on the operator's configuration.
Recommendation
It is recommended to immediately update OpenClaw to version 2026.4.27 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.