Executive brief
OpenClaw, a tool used for managing QQBot integrations, contains a flaw in how it handles approval requests. When using native QQBot approval buttons, the system fails to verify if the person clicking the button is actually an authorized approver. This could allow any user who can see the approval message to authorize sensitive actions or plugin executions, potentially leading to unauthorized operations or data access.
Technical details
A missing authorization vulnerability (CWE-862) exists in OpenClaw's QQBot channel. While text-based command approvals correctly enforce authorization checks, the callback path for native QQBot approval buttons does not verify the identity of the user interacting with the button against the configured approver list. An attacker with basic QQ access to a conversation where an approval button is present can trigger the button callback to resolve pending exec or plugin approvals. This issue is resolved in version 2026.5.18.
Affected products
- OpenClaw openclaw < 2026.5.18
Timeline
- 2026-05-28: disclosed: Initial disclosure by reporter
- 2026-05-28: patched: Version 2026.5.18 released
- 2026-07-02: advisory: GitHub Advisory published