Openclaw cli: OpenClaw: Mattermost handlers could fall open when channel type was missing (CVE-2026-53837)
Description
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.6 have a vulnerability where Mattermost event handlers may improperly process events missing channel type metadata, bypassing intended direct message (DM) policy enforcement. This could allow events that should be restricted by channel policy to be processed when the affected feature is enabled. The vulnerability does not affect the overall trusted-operator model of OpenClaw. A patch is available in version 2026.5.6. The CVSS score is 3.7, indicating low severity.
CVSS v3.1
Score 3.7low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw CLI versions >=2026.1.29 and <2026.5.6, Mattermost event handlers may continue processing events missing channel type metadata without applying the intended DM policy decision. This means that when the affected feature is enabled and reachable, events that should have been gated by channel policy could be processed, depending on operator configuration and input trust levels. The vulnerability does not alter the trusted-operator model of OpenClaw. The issue is fixed in version 2026.5.6.
Potential Impact
The vulnerability could allow processing of Mattermost events that should have been blocked by channel policy, potentially leading to unintended event handling. The practical impact depends on the operator's configuration and whether lower-trust inputs can reach the vulnerable code path. There is no impact on confidentiality or availability, and no known exploits in the wild.
Mitigation Recommendations
A patch is available in OpenClaw CLI version 2026.5.6 and should be applied. Until patched, restrict Mattermost bot access and review channel metadata errors carefully. Additionally, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature if it is not needed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-53837
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2458d12601ec6a3164136
Added to database: 10/04/2026, 12:24:45 UTC
Last enriched: 10/04/2026, 12:36:42 UTC
Last updated: 10/04/2026, 16:08:39 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.