Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- high
CVE-2026-53833: OpenClaw QQBot Incorrect Authorization on /bot-streaming Command
Any QQBot sender could invoke the /bot-streaming admin command and change OpenClaw streaming configuration, even without being on an explicit trusted-sender allowlist.
- high
CVE-2026-53823: OpenClaw Slack allowFrom Authentication Bypass via Mutable Display Names
OpenClaw's Slack allowlist matched on mutable display names instead of stable user IDs, letting any workspace member rename themselves to impersonate an allowlisted identity and gain agent access.
- high
CVE-2026-53821: openclaw Trusted-Proxy WebSocket Scope Elevation
A restricted or unpaired OpenClaw user on a trusted-proxy deployment could declare admin-level permissions on a WebSocket connection before the server ever verified those permissions, then use that…
- high
CVE-2026-53822: OpenClaw Shell Wrapper Argv TOCTOU Allowlist Bypass
OpenClaw's shell wrapper approval flow could be tricked into checking one command at approval time and running a completely different command at execution time, letting an attacker bypass the…
- highCVE-2026-53810
CVE-2026-53810: openclaw Marketplace Runtime Extension Metadata Code Injection
A crafted marketplace plugin package can point OpenClaw's runtime extension loader at hidden, unscanned code files, letting an installed plugin run arbitrary logic that was never reviewed during…
- high
CVE-2026-53832: openclaw Trusted-Proxy Identity Header Forgery via Same-Host Loopback
When OpenClaw's trusted-proxy auth mode was active, any local process on the same host could send a forged identity header directly to the Gateway port and authenticate as an arbitrary operator…
- highCVE-2026-53817
CVE-2026-53817: openclaw Control UI Locality Spoofing to Admin Token Mint
A flaw in how OpenClaw validated the network locality of Control UI pairing requests let an attacker with existing network access forge a loopback identity signal, skip manual approval, and walk…
- highCVE-2026-53814
CVE-2026-53814: openclaw Hook-Triggered CLI Privilege Escalation to Owner MCP Scope
Anyone holding an openclaw hook token can trigger an agent run that silently receives full owner-level MCP tool authority, letting an outsider call tools that should only be available to the…
- high
CVE-2026-35630: openclaw QQBot Native Approval Button Authorization Bypass
Any QQ user who can see an OpenClaw approval message could tap the native Allow button and authorize a pending exec or plugin action, even if they were not configured as an approver.
- high
CVE-2026-53831: openclaw system.run Safe-Bin Allowlist Bypass via Shell Expansion
OpenClaw's safe-bin allowlist for system.run checked command arguments before the shell expanded them, so a glob or environment variable that looked harmless at check time could silently become a…
- highCVE-2026-53815
CVE-2026-53815: openclaw Message Read Action Channel Allowlist Bypass
A flaw in OpenClaw's message read action lets a lower-trust caller fetch messages from channels they are not supposed to access, bypassing the operator-configured channel allowlist.
- high
CVE-2026-53829: openclaw Exec Approval Display Truncation
Authenticated users could submit an exec command long enough that the approval UI showed only a harmless-looking prefix, hiding a malicious suffix that would still run after the approver clicked…