PT-2026-49041 · Openclaw+1 · Openclaw+1

Keensecuritylab + 1 · CVE-2026-53837 · Published 2026-06-12 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description Improper access control in Mattermost event handlers occurs due to a failure to validate channel type metadata. This allows attackers to bypass intended Direct Message (DM) policy decisions by sending crafted Mattermost events that lack channel type information to process restricted content.

Recommendations Update to version 2026.5.6.

Exploit

Fix

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-53837

GHSA-GP79-M99V-GJMH

Affected Products

Mattermost

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53837.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gp79-m99v-gjmh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53837 · Security Note
• https://osv.dev/vulnerability/GHSA-gp79-m99v-gjmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53837 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2065840902241653083 · Twitter Post
• https://t.me/CVEtracker/56767 · Telegram Post
• https://vulncheck.com/advisories/openclaw-missing-channel-type-validation-in-mattermost-event-handlers · Note