Authorization Bypass in OpenClaw QQBot Slash Commands

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: VulnCheck

Description

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-02

NVD

CVE-2026-53834

EUVD

EUVD-2026-36622

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.4.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.27 and affects the QQBot pre-dispatch slash commands. It is an authorization bypass flaw that allows authenticated users to bypass the allowFrom policy checks. Essentially, attackers who are authenticated can invoke slash commands before the system applies the configured access control policies, which may allow them to execute commands even if they are supposed to be blocked based on the operator's configuration.

Impact Analysis

The impact of this vulnerability is that attackers who are authenticated can bypass access control restrictions and execute slash commands that should be blocked. This could lead to unauthorized command execution depending on how the operator has configured the system, potentially compromising the security and integrity of the affected environment.

Hi! I’m here to help you understand CVE-2026-53834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70