CVE-2026-35630: OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw asks a human to approve risky agent actions such as command execution and plugin calls. On QQBot, approvals can arrive as native buttons. The button callback resolved the approval without comparing the clicking QQ user with the configured approvers. The text-command approval path did run the authorization check, so only the button path was open.

The condition is that native approval buttons are on and the approval message is visible to a QQ user who is not an approver, for example in a group chat. That user clicks the button and the pending request is resolved. Depending on what was pending, an exec or plugin action that required an authorized approver runs without one.

The approval prompt is the control that keeps an AI agent's riskier actions under human review, so this flaw removes that review for whoever shares the conversation. The attacker needs a low-privilege QQ presence and a pending request. The CVSS vector marks user interaction because an approval has to be pending.

Affected: npm package openclaw before 2026.5.18, in deployments where QQBot native approval buttons are enabled and an approval message reaches QQ users who are not configured approvers.

npm ls openclaw

Then check your Gateway configuration for the QQBot channel and its approver settings. Deployments without QQBot buttons are not in scope.

Upgrade to openclaw 2026.5.18 or later, the first stable patched version.

npm install -g [email protected]

Before upgrading, the advisory says to avoid delivering native approval buttons into QQ conversations that include users who should not be able to approve. Approving through the text command path was not affected, because it checks authorization.

Compare the QQ user who resolved each recent exec or plugin approval with your configured approver list. Any approval resolved by a user outside that list, especially through a button click, is suspect. Then review the exec or plugin actions that followed it. The advisory publishes no log strings.

Summary

OpenClaw's QQBot channel can deliver native approval buttons for exec and plugin approvals. In affected releases, the button callback path resolved approvals without enforcing the configured QQBot approver identity.

The text command approval path used the authorization check; the issue was specific to native QQBot approval buttons.

Affected configurations

This affects deployments where QQBot native approval buttons are enabled and an approval message is visible to a QQ user who is not configured as an approver.

Impact

A non-approver who could see the approval message could click an approval button and resolve the pending request. Depending on the pending approval, this could allow an exec or plugin action that should have required an authorized approver.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

Upgrade to [email protected] or later. Before upgrading, avoid delivering native approval buttons into QQ conversations that include users who should not be able to approve.