CVE-2026-53834: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

The QQBot channel handles some slash commands in a pre-dispatch step. In affected versions that step ran before the allowFrom check, so the allowlist never got a chance to reject the sender. A message from a user outside the list could still reach command handling.

The attacker needs to be able to message the bot over QQBot and send a slash command. No code is run on their side and no exploit chain is needed. What they get depends on which commands exist in your deployment and what they do. The CVSS vector scores integrity impact only: the sender can cause actions the policy forbids, but the vector shows no data disclosure or outage.

The advisory keeps the trusted-operator model unchanged and says practical impact depends on configuration and on whether lower-trust input can reach this path. The sources do not list the commands. Teams that expose a QQBot channel to groups or public contacts are the most exposed.

The npm package openclaw at 2026.4.26 and earlier, when the QQBot channel is enabled and slash commands are reachable by senders outside allowFrom.

npm ls openclaw

Use npm ls -g openclaw for a global install. Versions up to 2026.4.26 are affected.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until then, the advisory says to restrict QQBot slash command exposure. General hardening it lists: keep channel and tool allowlists narrow, do not share one Gateway between mutually untrusted users, and disable the feature when you do not need it.

Review QQBot channel history and Gateway logs for slash commands sent by accounts that are not on your allowFrom list. Check for configuration or state changes that followed such messages. The sources give no log string. Note that earlier versions would have processed those commands before the policy check, so a missing deny line is not proof that nothing ran.

Summary

QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, a QQBot sender able to invoke slash commands could dispatch the command before applying the configured allowFrom policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could trigger command handling from a sender that policy should have blocked. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.27.

Mitigations

restrict QQBot slash command exposure until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.