Executive brief
OpenClaw, a tool used for managing bot interactions, contains a flaw in how it handles approval requests within the QQ messaging platform. Unauthorized users who can see an approval message can click the 'approve' button to bypass security checks and authorize sensitive actions, such as executing commands or activating plugins. This could allow unauthorized individuals to perform administrative tasks or access restricted system functions.
Technical details
An authorization bypass vulnerability (CWE-862) exists in OpenClaw's QQBot channel before version 2026.5.18. While text-based approval commands correctly enforce authorization, the callback path for native QQBot approval buttons fails to verify if the user clicking the button is a configured approver. An attacker with low privileges (a user in the same QQ conversation) can interact with these buttons to resolve pending 'exec' or 'plugin' approval requests. This allows for unauthorized execution of actions that should be restricted to authorized administrators. The issue is resolved in version 2026.5.18.
Affected products
- OpenClaw openclaw < 2026.5.18
Timeline
- 2026-05-28: advisory: Original advisory GHSA-mgq6-vr84-7m2j published
- 2026-05-29: disclosed: NVD publication of CVE-2026-35630
- 2026-07-02: patched: Advisory updated and duplicate withdrawn; fix confirmed in 2026.5.18