What is CVE-2026-53834?

CVE-2026-53834 is a high-severity vulnerability in Openclaw, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2026-06-12.

How severe is CVE-2026-53834?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Openclaw

CVE-2026-53834

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.

Vulnerability class: Broken Access Control

EPSS: 0.002 (9.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Openclaw — versions 0, 2026.4.27

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

disclosure@vulncheck.com (vendor-advisory, Mitigation, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-53834?: CVE-2026-53834 is a high-severity vulnerability in Openclaw, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2026-06-12.
How severe is CVE-2026-53834?: High severity. CVSS v3 base score is 7.5 out of 10.