Threats tagged 'ghsa-mgq6-vr84-7m2j'

OpenClaw CLI versions prior to 2026.5.18 have a vulnerability in the QQBot native approval buttons where the configured approver identity is not enforced. This allows any QQ user who can see an approval message to click the approval button and resolve the request, potentially executing actions without proper authorization. The issue is specific to native QQBot approval buttons and does not affect text command approvals. A fix is available in version 2026.5.18.