PT-2026-49041 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53837

NVD

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.

Fix

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-53837

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gp79-m99v-gjmh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53837 · Security Note
• https://vulncheck.com/advisories/openclaw-missing-channel-type-validation-in-mattermost-event-handlers · Note