CVE-2026-53837

Vulnerability

OpenClaw versions before 2026.5.6 contain an improper access control vulnerability in Mattermost event handlers (CWE-636, Not Failing Securely) [1][2]. The handlers fail to validate channel type metadata when processing incoming Mattermost events. If the channel type field is missing from the event, the intended direct message (DM) policy decision is not applied, allowing the event to proceed without the expected restriction [1][2]. The vulnerability is present in the affected feature when it is enabled and reachable; the OpenClaw trusted-operator model remains otherwise unchanged [1].

Exploitation

An attacker with the ability to send crafted Mattermost events to an affected OpenClaw instance can exploit this vulnerability. No authentication is required to send the event if the handler is exposed, though network proximity and knowledge of the event structure are necessary [2]. The attacker sends a Mattermost event that is missing the channel type metadata field. Because the handler does not fail securely when metadata is absent, the event proceeds without applying the DM policy that would normally restrict processing [1][2]. Success depends on the operator's configuration and whether lower-trust input can reach that code path [1].

Impact

Successful exploitation allows an attacker to bypass intended DM policy decisions and cause OpenClaw to process restricted content [1][2]. The confidentiality and integrity impact is low; availability is not affected [2]. The practical impact varies based on the operator's configuration and the sensitivity of the content that would otherwise be gated [1]. In the worst case, an attacker may trigger processing of messages that should have been blocked, potentially leading to unintended information disclosure or processing of malicious content [2].

Mitigation

The first patched version is 2026.5.6 [1][2]. Operators should upgrade to this version or later. As a workaround until patched, keep Mattermost bot access restricted, review channel metadata errors, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed [1]. No KEV listing has been published at this time.