CVE-2026-53833Disclosure(openclaw / openclaw)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

openclaw CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-06-13); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-13	3	Disclosure3
2026-06-15	1	Disclosure1

Full discourse4 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters134d
Disclosure
#CVE-2026-53833 - Authorization bypass in Openclaw QQBot. Authenticated attackers can mutate config outside intended policy. CVSS 7.7. No patch available. Restrict access immediately. #CVE #Openclaw #infosec More Detailed info with Labs: https://www.valtersit.com/cve/CVE-2026-53833/
Post summary
The tweet announces an authorization bypass vulnerability in Openclaw QQBot (CVE-2026-53833), detailing its impact, CVSS score, and lack of a current patch while urging immediate access restriction.
0001097
929 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-53833 OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration with… https://www.cve.org/CVERecord?id=CVE-2026-53833 ----- Traducción: CVE-2026-53833 Ope… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑53833, an authorization bypass in OpenClaw’s QQBot streaming command, without mentioning a PoC, exploit, or mitigation.
0000039
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-53833 OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration with… https://www.cve.org/CVERecord?id=CVE-2026-53833
Post summary
CVE-2026-53833 is disclosed as an authorization bypass flaw in OpenClaw’s QQBot streaming command, enabling authenticated users to alter configuration settings.
00000238
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-53833 Authorization Bypass in OpenClaw QQBot Streaming Command Before 2026.4.29 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53833
Post summary
The post announces a new Authorization Bypass vulnerability (CVE‑2026‑53833) in OpenClaw QQBot’s streaming command, noting the affected version, but provides no details on exploitation, patches, or active attacks.
0000062
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-53833

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The tweet announces an authorization bypass vulnerability in Openclaw QQBot (CVE-2026-53833), detailing its impact, CVSS score, and lack of a current patch while urging immediate access restriction.

Infoflowcloud@infoflowcloudDisclosure

The text announces CVE‑2026‑53833, an authorization bypass in OpenClaw’s QQBot streaming command, without mentioning a PoC, exploit, or mitigation.

CVE@CVEnewDisclosure

CVE-2026-53833 is disclosed as an authorization bypass flaw in OpenClaw’s QQBot streaming command, enabling authenticated users to alter configuration settings.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a new Authorization Bypass vulnerability (CVE‑2026‑53833) in OpenClaw QQBot’s streaming command, noting the affected version, but provides no details on exploitation, patches, or active attacks.