Search: CVE-2026-53833

A vulnerability in OpenClaw CLI's QQBot streaming command allows mutation of configuration without requiring an explicit allowFrom whitelist entry. This can lead to unauthorized configuration changes when the feature is enabled and accessible. The issue affects versions from 2026.1.29 up to but not including 2026.4.29. A patch is available in version 2026.4.29. Mitigations include disabling the command or restricting it to trusted senders until patched.