GHSA-w4v6-g3wm-w36c: OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

QQBot is a messaging channel for OpenClaw. It has its own policy: admin commands should work only in direct messages and only from senders on an allowFrom list. In affected versions, an exported QQBot command could route admin commands past both checks. The result is that admin behavior runs for a sender or context that policy should have blocked.

The advisory is brief. It does not list the admin commands or what they change, so the worst case cannot be stated from the sources. It says the practical impact depends on the operator's configuration and on whether lower-trust input can reach that path. It also says this does not change OpenClaw's trusted-operator model: authenticated Gateway operators and installed plugins stay trusted.

The exposure is a Gateway with QQBot enabled where people outside the intended admin group can message the bot, for example in group chats. Deployments that do not use QQBot are not exposed. The advisory scores it 9.3 under CVSS 4.0 with no privileges or interaction needed.

Affected: npm package openclaw before 2026.4.29, with the QQBot feature enabled and reachable by senders who should not have admin rights.

npm ls openclaw
openclaw --version

The second command assumes the CLI is on your PATH. Then check whether your Gateway configuration enables the QQBot channel.

Upgrade to openclaw 2026.4.29 or later, the first stable patched version.

npm install -g [email protected]

Mitigations from the advisory until you can upgrade: disable the exported QQBot admin commands or restrict QQBot access. For general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and turn off the feature when you do not need it.

The advisory names no log lines or indicators. Review QQBot channel logs for admin commands that came from group chats or from senders missing from your allowFrom list. Compare the Gateway's recent configuration and admin actions with what your operators did. Anything an unlisted sender triggered through QQBot points to this flaw.

Summary

QQBot admin commands could skip DM-only and allowFrom policy. In affected versions, a QQBot sender able to trigger the exported command could route admin commands without the QQBot-specific DM-only and allowFrom checks.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could run QQBot admin behavior from a sender or context that policy should have blocked. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.29.

Mitigations

disable exported QQBot admin commands or restrict QQBot access until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.