Vulnerabilities

TI-2026-38833 CVE-2026-53837 · GHSA-gp79-m99v-gjmh

OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers

LOW 27

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00189 Published 2026-06-12 Fixed in 2026.5.6 CWE-636

TI-2026-38831 CVE-2026-53835 · GHSA-gjr2-gw52-3xch

OpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings

LOW 11

OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create or update bindings without honoring configured config-write…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00166 Published 2026-06-12 Fixed in 2026.5.6 CWE-863

TI-2026-38824 CVE-2026-53828 · GHSA-rwhc-83x6-c8f9

OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement

LOW 35

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00267 Published 2026-06-12 Fixed in 2026.5.6 CWE-863

Vulnerabilities

Filters

OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers

OpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings

OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement