Executive brief
OpenClaw is an AI automation platform that executes commands across different operating systems and platforms. The QQBot component has an authorization bypass vulnerability that allows authenticated senders to invoke slash commands before access control policies are applied, potentially enabling unauthorized command execution from blocked senders depending on the operator's configuration.
Technical details
This is an authorization bypass vulnerability (CWE-863) in OpenClaw's QQBot component affecting versions before 2026.4.27. The root cause is insufficient authorization checks in the pre-dispatch phase of slash command processing—authenticated senders can invoke commands before the allowFrom access control policy is applied. The vulnerability requires network access and authentication but no user interaction or elevated privileges. An authenticated attacker can invoke slash commands from senders that should be blocked by the allowFrom policy, potentially triggering unintended command handling depending on the operator's configuration. The patch is available in version 2026.4.27 and later. Mitigation includes restricting QQBot slash command exposure and applying policy to narrow channel and tool allowlists.
Affected products
- OpenClaw OpenClaw <2026.4.27
Timeline
- 2026-05-28: disclosed: Original advisory published
- 2026-04-27: patched: Version 2026.4.27 contains the fix
- 2026-06-13: other: Duplicate advisory GHSA-35c7-4r45-9gv3 published
- 2026-08-28: other: Duplicate advisory withdrawn