CVE-2026-53833

HIGH

7.7

CVSS Severity Score

EPSS Score0.0690%

EPSS Percentile21.83th

Published2026年6月12日

Last Modified2026年6月12日

Vulnerability Description

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://github.com/openclaw/openclaw/security/advisories/GHSA-jvm4-4j77-39p6

🔗 https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-qqbot-streaming-command

Vulnerability Description

Affected Platforms (CPE)

References & Advisories

相關漏洞威脅