PT-2026-49037 · Qqbot · Qqbot

Anshuman Bhartiya · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53833

NVD

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-53833

Affected Products

Qqbot

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jvm4-4j77-39p6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53833 · Security Note
• https://vulncheck.com/advisories/openclaw-authorization-bypass-via-qqbot-streaming-command · Note