Loading story…
OpenClaw disclosed several high-severity vulnerabilities affecting multiple releases, including authorization bypass in QQBot pre-dispatch slash commands, privilege escalation in the trusted-proxy Control UI WebSocket, and node authority expansion through pairing reconnection logic. The QQBot issue, tracked as CVE-2026-53834 and mirrored in GitHub advisory GHSA-77pv-3w4q-vrj5, affects versions up to 2026.4.26 and allows senders to trigger slash-command handling before allowFrom policy checks are enforced. The vendor said the flaw is limited to the QQBot feature and its configuration, with the first stable fix released in 2026.4.27.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
A high-severity vulnerability, CVE-2026-53857, was published for OpenClaw versions earlier than 2026.5.3. The flaw allows authentication bypass because allowFrom authorization compares a mutable DisplayName instead of an immutable UserID, enabling sender spoofing and potentially exposing internal APIs, sensitive data, and execution-capable tooling to unauthorized use.
A new vulnerability, CVE-2026-53850, was published for OpenClaw describing missing authorization checks in the focus command's control-scope enforcement. The flaw allows an authenticated low-privilege user to switch focus to unauthorized sessions or workspaces, and the reference says version 2026.4.25 adds explicit validation to fix the issue.
A new vulnerability, CVE-2026-53852, was published for OpenClaw describing a scope containment bypass in the device re-pairing routine. An authenticated operator can submit an empty or falsy scope parameter and retain broader previously active permissions instead of having the session restricted.
A medium-severity vulnerability, CVE-2026-53854, was published for OpenClaw versions prior to 2026.4.25. The flaw allows low-privilege users on internal or webchat interfaces to inherit wildcard-based owner permissions retained from another channel, potentially enabling owner-level command execution and access to session data.
A high-severity vulnerability, CVE-2026-53843, was published for OpenClaw versions before 2026.5.26. The flaw allows a surviving pairing-scoped device session to re-establish node token authority after revocation, potentially restoring WebSocket node-level access without renewed approval.
A high-severity vulnerability, CVE-2026-53849, was published for OpenClaw versions before 2026.5.7. The flaw lets unauthorized Discord users impersonate authorized identities by changing mutable display names used by allowFrom checks, potentially gaining agent access intended for another account.
A new high-severity vulnerability, CVE-2026-53866, was published for OpenClaw versions prior to 2026.5.12. The flaw is an allowlist bypass in shell inline-command parsing that can let authenticated operators execute unapproved commands because one parser path skips the expected allowlist decision and approval prompt.
A new vulnerability, CVE-2026-53838, was disclosed for OpenClaw versions before 2026.5.27. The flaw can mutate node pairing state during reconnection and potentially restore broader node authority than intended.
The CVE-2026-53834 entry states the vulnerability was received by disclosure@vulncheck.com on June 12, 2026. It affects OpenClaw versions before 2026.4.27 and describes an authorization bypass in QQBot pre-dispatch slash commands.
The CVE-2026-53821 entry states the vulnerability was received by disclosure@vulncheck.com on June 12, 2026. The flaw affects OpenClaw versions before 2026.5.18 and allows trusted-proxy Control UI WebSocket scope elevation.
A GitHub security advisory disclosed that OpenClaw versions earlier than 2026.5.20 allowed hook-triggered automated runs to select a bundled CLI backend that incorrectly received owner-scoped MCP loopback authority. The advisory states the first stable patched version is 2026.5.20.
A GitHub security advisory disclosed that OpenClaw versions up to and including 2026.4.26 were affected by a QQBot pre-dispatch slash command flaw that could bypass allowFrom checks. The advisory stated the first stable patched release was version 2026.4.27.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in OpenClaw exposed paths for authenticated users to gain access beyond their intended roles. **CVE-2026-32042** affects versions before `2026.2.25` and allows an attacker with valid shared gateway authentication to present a self-signed, unpaired device identity and bypass pairing requirements, then self-assign elevated operator scopes including `operator.admin`. The issue is classified as `CWE-863` and effectively turns a trusted but unapproved device identity into a route for privilege escalation. A second flaw, **CVE-2026-32051**, affects OpenClaw versions before `2026.3.1` and allows users with `operator.write` scope to reach owner-only tool surfaces such as gateway and cron through agent runs in scoped-token deployments. The authorization mismatch lets lower-privileged authenticated users perform control-plane actions that should be restricted to owners, creating high risk to confidentiality, integrity, and availability. Advisories for both issues point to fixes and security guidance through GitHub and VulnCheck.
Jun 29, 2026
Two high-severity vulnerabilities in **OpenClaw** exposed weaknesses in how the platform enforced messaging restrictions in its chat integrations. **`CVE-2026-32975`** affects versions before **`2026.3.12`** and stems from weak authorization in Zalouser allowlist mode, where access checks used mutable group display names instead of stable group identifiers. That design allowed an attacker to create a group with the same name as an allowlisted group and bypass channel authorization, potentially causing messages from unintended groups to be routed to the agent. A second flaw, **`CVE-2026-33578`**, affects versions before **`2026.3.28`** in the **Google Chat** and **Zalouser** extensions. In that case, route-level group allowlist policies could silently downgrade to an open sender policy, letting attackers bypass configured sender restrictions and interact with bots that should have been limited to approved groups. Both issues were rated **high severity** with impact to confidentiality, integrity, and availability, and advisories and code references were published alongside fixes in newer OpenClaw releases.
Jun 29, 2026
OpenClaw disclosed two high-severity vulnerabilities affecting versions before `2026.2.21` and `2026.3.25`, exposing gateway routes to unauthorized access and privilege escalation. **CVE-2026-32045** is an authentication bypass in HTTP gateway routes caused by incorrect application of tokenless Tailscale header authentication, allowing attackers on trusted networks to reach protected routes without valid tokens or passwords. The issue is tracked as `CWE-290` and carries a CVSS v3.1 vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`, indicating a confidentiality-focused impact.
Jun 29, 2026