PT-2026-49038 · Qqbot+1 · Qqbot+1

Keensecuritylab + 1 · CVE-2026-53834 · Published 2026-06-12 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.27

Description An authorization bypass exists in QQBot pre-dispatch slash commands. This issue allows authenticated senders to skip allowFrom policy checks, enabling them to invoke slash commands before configured access control policies are applied. Depending on the operator configuration, this may trigger command handling from senders who should be blocked.

Recommendations Update to version 2026.4.27.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-53834

GHSA-77PV-3W4Q-VRJ5

Affected Products

Openclaw

Qqbot

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53834.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-77pv-3w4q-vrj5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77pv-3w4q-vrj5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53834 · Security Note
• https://osv.dev/vulnerability/CVE-2026-53834 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/208171 · Telegram Post
• https://twitter.com/infoflowcloud/status/2065841964113633747 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-qqbot-pre-dispatch-slash-commands · Note
• https://t.me/CVEtracker/56764 · Telegram Post
• https://twitter.com/CVEnew/status/2065840905802650029 · Twitter Post