[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

Descripción técnica

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

Puntuación CVSS

Score: 7.7/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Productos afectados

Openclaw — Openclaw

Debilidades (CWE)

CWE-290

Fuente oficial

Publicado en NIST NVD.