OpenClaw CVE-2026-53834

Exploitation requires the attacker to be an authenticated sender on the messaging platform that QQBot listens on (a valid QQ account able to deliver a message to the bot), and the OpenClaw operator must have deployed QQBot with an allowFrom policy that the attacker's sender ID is intended to fail - without such a policy there is nothing to bypass. The CVSS 4.0 Attack Requirement (AT:P) reflects this configuration dependency: only operators using allowFrom-based access control are exposed, and the realized impact depends on which slash commands the bypassed handler actually exposes in that deployment.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates network-reachable exploitation with low complexity but a meaningful Attack Requirement (AT:P), meaning success depends on specific deployment conditions - consistent with the description's note that impact varies 'depending on operator configuration.' Vulnerable-system integrity is High (VI:H) while confidentiality and availability are None, narrowing real impact to unauthorized command invocation rather than data theft or outage. There is no KEV listing and no public exploit identified, and EPSS data was not provided; combined with the AT:P requirement and configuration-dependent impact, this is a meaningful patch-soon issue for OpenClaw operators running QQBot with allowFrom policies, but not an emergency for deployments that do not rely on sender-based access control. PR:N in the vector conflicts slightly with the description's mention of 'authenticated senders' - likely because messaging-platform authentication is treated as out-of-scope for the application's own auth model; verify with vendor if precise prerequisites matter.

An attacker whose sender identity is explicitly listed in QQBot's allowFrom deny rules - for example, a former employee's messaging account or a flagged abusive sender - sends a slash command to the bot over the normal messaging channel. Because the pre-dispatch handler runs before allowFrom evaluation, the command is processed and any side effects (e.g., querying state, triggering automations) occur despite the operator's explicit block, with no public exploit currently identified.