CVE-2026-53837CWE-636

OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers

Medium · published June 12, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-636 · Not Failing Securely ('Failing Open')
Published
2026-06-12T21:57Z
EPSS history
Timeline
  • 12 JUN 21:57Z
    OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers
    cvelistv5