Search: CVE-2026-53837

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.6 have a vulnerability where Mattermost event handlers may improperly process events missing channel type metadata, bypassing intended direct message (DM) policy enforcement. This could allow events that should be restricted by channel policy to be processed when the affected feature is enabled. The vulnerability does not affect the overall trusted-operator model of OpenClaw. A patch is available in version 2026.5.6. The CVSS score is 3.7, indicating low severity.