OpenClaw authorization bypass in QQBot slash commands

Executive brief

OpenClaw is a gateway tool used for managing bot interactions, such as those on the QQ messaging platform. A security flaw was found where certain commands could bypass safety checks designed to restrict who can send them. This could allow unauthorized users to trigger bot actions that should have been blocked by the system's security policy.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in OpenClaw's QQBot integration. In affected versions, slash commands are dispatched before the 'allowFrom' policy is applied, effectively bypassing sender-based access control lists. A remote attacker capable of sending slash commands to the bot can execute these commands even if they are not on the authorized sender list. This issue is specific to the pre-dispatch handling of slash commands and has been addressed in version 2026.4.27.

Affected products

• openclaw openclaw <= 2026.4.26

Timeline

• 2026-05-28: disclosed
• 2026-07-02: advisory
• 2026.4.27: patched

References

• https://api.github.com/users/zsxsoft
• https://github.com/zsxsoft
• https://api.github.com/users/zsxsoft/gists%7B/gist_id%7D
• https://api.github.com/users/zsxsoft/repos
• https://avatars.githubusercontent.com/u/2398785?v=4
• https://api.github.com/users/zsxsoft/events%7B/privacy%7D