CVE-2026-53833: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

OpenClaw's QQBot channel has a streaming command that edits configuration. It should be limited to senders named in an explicit, non-wildcard allowFrom list. In affected versions the command did not require that entry, so a sender who merely reached the command could modify the QQBot streaming settings.

The attacker must be able to send messages to the bot on the QQBot channel, so the path depends on who can message your agent. What they change is QQBot streaming configuration, outside the intended admin policy. That is a narrower result than code execution. It still lets an untrusted chat participant alter how the agent's channel behaves.

The advisory keeps OpenClaw's trusted-operator model unchanged and says real impact depends on whether lower-trust input can reach the command. The sources do not name the command or the settings it changes. The vendor's CVSS vector is local with no privileges, while the text says the sender is authenticated. Treat the text as the guide to who can exploit it.

The npm package openclaw at 2026.4.27 and earlier, with the QQBot channel enabled and the streaming command reachable by senders who are not on an explicit allowFrom list.

npm ls openclaw

Use npm ls -g openclaw for a global install. Anything at or below 2026.4.27 is affected.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until you upgrade, the advisory says to disable the command or restrict it to explicit trusted QQBot senders. It also suggests narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the feature if unused.

Check your OpenClaw configuration for QQBot streaming settings you did not set, and compare them with your last known good config or version control. Review QQBot channel history for streaming-command messages from senders outside your allowFrom list. The sources give no log string for this flaw.

Summary

QQBot streaming command could mutate config without explicit allowFrom. In affected versions, a QQBot sender reaching the affected command could change configuration without requiring an explicit non-wildcard allowlist entry.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could modify QQBot streaming configuration outside the intended admin policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.29.

Mitigations

disable the command or restrict it to explicit trusted QQBot senders until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.