CVE-2026-53834
Received Received - Intake
Authorization Bypass in OpenClaw QQBot Slash Commands

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: VulnCheck

Description
OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-13
AI Q&A
2026-06-13
EPSS Evaluated
N/A
NVD
CVE-2026-53834
EUVD
EUVD-2026-36622
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
openclaw openclaw to 2026.4.27 (exc)
qqbot qqbot to 2026.4.27 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.27 and affects the QQBot pre-dispatch slash commands. It is an authorization bypass flaw that allows authenticated users to bypass the allowFrom policy checks. Essentially, attackers who are authenticated can invoke slash commands before the system applies the configured access control policies, which may allow them to execute commands even if they are supposed to be blocked based on the operator's configuration.

Impact Analysis

The impact of this vulnerability is that attackers who are authenticated can bypass access control restrictions and execute slash commands that should be blocked. This could lead to unauthorized command execution depending on how the operator has configured the system, potentially compromising the security and integrity of the affected environment.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart