Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

OpenClaw allows unauthorized direct messages via malformed Mattermost events

CVE-2026-53837 · published 4 months ago
Summary

Older versions of OpenClaw (before 2026.5.6) do not check the channel type in certain Mattermost messages. This lets a malicious user send specially crafted events that skip the usual direct‑message rules, potentially exposing private conversations. Upgrade OpenClaw to the latest version or apply the vendor's patch to restore proper access checks.

What to do
  • Update openclaw to version 2026.5.6.
  • Update openclaw openclaw to version 2026.5.6 or later.
Affected software
Ecosystem VendorProductAffected versions
– openclaw openclaw < 2026.5.6
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
npm – openclaw <= 2026.5.5
Fix: upgrade to 2026.5.6
Original advisory text
OpenClaw: Mattermost handlers could fall open when channel type was missing
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-636Not Failing Securely ('Failing Open')
Timeline
Published2 Jul 2026
Updated30 Oct 2026
First seen12 Jun 2026
Sources
CVE-2026-53837 · NVD
CVE-2026-53837 · OSV
Track software like this
Free during beta