Authorization Bypass in OpenClaw QQBot Streaming Command

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: VulnCheck

Description

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-02

NVD

CVE-2026-53833

EUVD

EUVD-2026-36621

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.4.29 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.29 and involves an authorization bypass in the QQBot streaming command. Authenticated users can change the QQBot streaming configuration without proper restrictions, specifically bypassing the intended allowFrom restrictions. This means attackers who have some level of access can modify configurations beyond what the admin policy allows, by exploiting the command without needing a specific non-wildcard allowlist entry.

Impact Analysis

The impact of this vulnerability is that attackers with authenticated access can alter the QQBot streaming configuration in ways not intended by administrators. This could lead to unauthorized changes in system behavior, potentially compromising the security or stability of the affected system. Since the vulnerability allows configuration mutation without proper authorization checks, it could be exploited to bypass security controls or disrupt normal operations.

Hi! I’m here to help you understand CVE-2026-53833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70