CVE-2026-53833CWE-290

CVE-2026-53833

High · published June 13, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-13T02:16Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.4.292026.4.29
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-jvm4-4j77-39p6 · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-qqbot-streaming-command · [email protected]
EPSS history
Timeline
  • 12 JUN 21:56Z
    QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command
    cvelistv5