Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
Description
OpenClaw versions before 2026.4.27 have an authorization bypass vulnerability in QQBot pre-dispatch slash commands. This flaw allows authenticated users to bypass allowFrom policy checks, enabling them to invoke slash commands before access control policies are enforced. The vulnerability can lead to unauthorized command execution depending on operator configuration.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw prior to version 2026.4.27 contains a CWE-863 authorization bypass vulnerability affecting QQBot pre-dispatch slash commands. Authenticated senders can skip allowFrom policy checks, permitting invocation of slash commands before configured access control policies are applied. This may result in command handling from senders who would normally be blocked, depending on operator settings. The vulnerability has a CVSS 3.1 score of 7.5 (High), indicating a network attack vector with low complexity and no privileges or user interaction required. A patch is available to address this issue.
Potential Impact
The vulnerability allows authenticated attackers to bypass access control restrictions on slash commands, potentially enabling unauthorized command execution. This could lead to integrity impacts by allowing commands from blocked senders to be processed. There is no confidentiality or availability impact reported. Exploitation does not require privileges or user interaction and can be performed remotely over the network.
Mitigation Recommendations
A patch is available for OpenClaw to fix this authorization bypass vulnerability. Users should upgrade to version 2026.4.27 or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-35c7-4r45-9gv3
- Osv Schema Version
- 1.4.0
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a91c075acd9273b491e7b03
Added to database: 08/28/2026, 17:08:05 UTC
Last enriched: 09/08/2026, 03:37:18 UTC
Last updated: 10/03/2026, 22:06:06 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.