CVE-2026-53851
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile — higher than 10% of all known CVEs
Summary
OpenClaw before version 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications.
Risk Assessment
Attackers can trigger unintended agent processing, potentially leading to unauthorized processing of lower-trust input.
Recommendation
It is recommended to update OpenClaw to version 2026.5.12 or later to mitigate this vulnerability.
Original NVD description (English source)
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.