The QQBot streaming command in OpenClaw versions prior to 2026.4.29 can mutate configuration settings without requiring an explicit non-wildcard allowFrom entry. This means a QQBot sender with access to the affected command could alter configuration outside intended administrative policies. The vulnerability does not affect the trusted-operator model of OpenClaw, which assumes authenticated Gateway operators, installed plugins, and local execution surfaces remain trusted unless additional policy boundaries are crossed. The practical impact depends on whether lower-trust inputs can reach the affected command path and if the feature is enabled.

If the affected feature is enabled and accessible, an attacker controlling a QQBot sender could modify streaming configuration settings without proper authorization, potentially violating administrative policies. This could lead to unauthorized configuration changes with high confidentiality and integrity impact, but availability is not affected. The severity is high with a CVSS 3.1 score of 7.7, reflecting local attack vector, low complexity, no privileges required, and no user interaction needed.

A patch is available in OpenClaw version 2026.4.29 that fixes this vulnerability. Until the patch is applied, it is recommended to disable the QQBot streaming command or restrict its use to explicitly trusted QQBot senders. Additionally, narrowing channel and tool allowlists, avoiding sharing a Gateway between mutually untrusted users, and disabling the affected feature when not needed provide further hardening.