CVE-2026-53834

Vulnerability

OpenClaw versions prior to 2026.4.27 contain an authorization bypass vulnerability in the QQBot pre-dispatch slash command handling. When the affected feature is enabled, authenticated senders can invoke slash commands before the configured allowFrom policy checks are applied. This allows commands to be dispatched without verifying whether the sender is permitted by the access control list. The official advisory notes that the issue is scoped to this specific feature and configuration, and does not affect other parts of the OpenClaw trusted-operator model [1][2].

Exploitation

An attacker who is authenticated as a QQBot sender and can invoke slash commands simply sends a slash command to the bot. Due to the pre-dispatch order, the command is processed before the allowFrom policy is consulted, thereby skipping the intended access control. No additional privileges or user interaction beyond authenticated access to QQBot is required. The vulnerability can be exploited over the network with low attack complexity and no privileges beyond the initial authenticated session [1][2].

Impact

Successful exploitation allows the attacker to trigger command handling from a sender that the configured policy should have blocked. The practical impact depends on the operator's configuration and whether lower-trust input can reach that command path. According to the advisory, the confidentiality impact is none, but the integrity impact is high, meaning the attacker could execute unauthorized commands. There is no availability impact [1][2].

Mitigation

OpenClaw patched this vulnerability in version 2026.4.27. Operators should update to this version or later. If an immediate update is not possible, mitigations include restricting QQBot slash command exposure, keeping channel and tool allowlists narrow, avoiding sharing one Gateway between mutually untrusted users, and disabling the affected feature when it is not needed [1][2].