CVE-2026-53815CWE-862

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

High · published June 11, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-11T20:08Z
EPSS history
Timeline
  • 11 JUN 20:08Z
    OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions
    cvelistv5