High severity7.7NVD Advisory· Published Jun 12, 2026· Updated Jun 16, 2026
CVE-2026-53833
CVE-2026-53833
Description
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/openclaw/openclaw/security/advisories/GHSA-jvm4-4j77-39p6nvdMitigationVendor Advisory
- www.vulncheck.com/advisories/openclaw-authorization-bypass-via-qqbot-streaming-commandnvdThird Party Advisory
News mentions
1- OpenClaw: 25 CVEs Disclosed in Largest Security Batch, Including Code Execution and Critical Auth BypassVypr Intelligence · Jun 12, 2026