Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-53815: OpenClaw lets low-trust users read restricted channel messages
CVE-2026-53815 · published 4 months ago
Summary
In versions of OpenClaw released before May 19, 2026, the system does not properly check whether a user is allowed to view messages from certain channels. This means someone with limited permissions could see messages that should be hidden from them. Upgrade OpenClaw to the latest version released on or after May 19, 2026 to fix the issue.
What to do
- Update GitHub Actions openclaw to version 2026.5.19.
- Update openclaw openclaw to version 2026.5.19 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | openclaw |
<= 2026.5.19-beta.2 < 2026.5.19 Fix: upgrade to 2026.5.19
|
| – | openclaw | openclaw |
< 2026.5.19 cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
Original advisory text
OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions
OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.
References
- https://github.com/advisories/GHSA-q7q8-3mgw-q67r
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53815... Vendor Advisory
- https://github.com/openclaw/openclaw/security/advisories/GHSA-q7q8-3mgw-q67r Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-53815 Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-channel-allowlist-bypass-in-messag... Vendor Advisory
- https://github.com/openclaw/openclaw Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-862Missing Authorization
CWE-200Information Exposure
Timeline
Published11 Jun 2026
Updated29 Oct 2026
First seen11 Jun 2026
Sources
CVE-2026-53815 · NVD
GHSA-q7q8-3mgw-q67r · GHSA
GHSA-q7q8-3mgw-q67r · OSV
CVE-2026-53815 · OSV
Track software like this
Free during beta