Description
OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.
Published: 2026-06-11
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenClaw before 2026.5.19 contains an authorization bypass in message read actions that skips channel allowlist checks. This flaw allows callers with lower trust levels to request messages from channels that are not intended for them, potentially exposing sensitive channel content. The weakness falls under CWE-862, representing missing authorization controls.

Affected Systems

Vendors: OpenClaw. Product: OpenClaw. Versions affected are any releases before 2026.5.19. No additional version details are provided beyond the cutoff mentioned.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium to high severity vulnerability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote API calls to the message read endpoint, which would require authentication but can bypass internal channel authorization. Attackers may exploit this to read confidential messages from unauthorized channels.

Generated by OpenCVE AI on June 11, 2026 at 21:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.5.19 or later to apply the vendor‑released fix.
  • If an upgrade cannot be performed immediately, restrict the use of the message read API to trusted callers and block lower‑trust callers from accessing the endpoint.
  • Verify that channel allowlist checks are enforced in the upgraded deployment by testing read permissions against restricted channels.

Generated by OpenCVE AI on June 11, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 11 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.
Title OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-862
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-06-11T20:08:52.351Z

Reserved: 2026-06-10T21:14:38.834Z

Link: CVE-2026-53815

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-06-11T21:16:23.697

Modified: 2026-06-11T21:16:23.697

Link: CVE-2026-53815

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T22:00:08Z

Weaknesses