Skip to content
Heist/ feed
Back to feed
High

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

Type: advisorySources: OSV

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-53815
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 04:03 UTC · Revision 1

Source evidence

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

core-osv · Original source

Published 11 Jun 2026, 20:08 UTC

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.

osv:CVE-2026-53815
Complete source record
{
  "id": "2b9ef9e37dacd27c751de2b9f96060cae9355ef8605839ba2d50bc0ae604b3bc",
  "url": "https://osv.dev/vulnerability/CVE-2026-53815",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions",
    "summary": "OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.",
    "evidence": "osv:CVE-2026-53815",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-53815",
      "aliases": [
        "CVE-2026-53815",
        "GHSA-q7q8-3mgw-q67r"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/openclaw/openclaw",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a185ca283a74092d3840d0c81c53cf02e25024e8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.5.19"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.5.19"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2026.4.19-beta.2",
            "v2026.4.19-beta.1",
            "v2026.4.15",
            "v2026.4.15-beta.2",
            "v2026.4.15-beta.1",
            "v2026.4.14",
            "v2026.4.14-beta.1",
            "v2026.4.12",
            "v2026.4.12-beta.1",
            "v2026.4.11",
            "v2026.4.11-beta.1",
            "v2026.4.10",
            "v2026.4.9",
            "v2026.4.9-beta.1",
            "v2026.4.8",
            "v2026.4.7-1",
            "v2026.4.7",
            "v2026.4.5",
            "v2026.4.2",
            "v2026.4.1",
            "v2026.4.1-beta.1",
            "v2026.3.31",
            "v2026.3.31-beta.1",
            "v2026.3.28",
            "v2026.3.28-beta.1",
            "v2026.3.24",
            "v2026.3.24-beta.2",
            "v2026.3.24-beta.1",
            "v2026.3.23-2",
            "v2026.3.23",
            "v2026.3.23-beta.1",
            "v2026.3.22",
            "v2026.3.22-beta.1",
            "v2026.3.13-1",
            "v2026.3.13",
            "v2026.3.12",
            "v2026.3.11",
            "v2026.3.11-beta.1",
            "v2026.3.8",
            "v2026.3.8-beta.1",
            "v2026.3.7",
            "v2026.3.7-beta.1",
            "v2026.3.2-beta.1",
            "v2026.3.2",
            "v2026.3.1",
            "v2026.2.26",
            "v2026.2.26-beta.1",
            "v2026.2.25",
            "v2026.2.25-beta.1",
            "v2026.2.24",
            "v2026.2.24-beta.1",
            "v2026.2.23",
            "v2026.2.23-beta.1",
            "v2026.2.22",
            "v2026.2.22-beta.1",
            "v2026.2.21",
            "v2026.2.21-beta.1",
            "v2026.2.19-beta.1",
            "v2026.2.19",
            "v2026.2.17",
            "v2026.2.15-beta.1",
            "v2026.2.14",
            "v2026.2.13",
            "v2026.2.12",
            "v2026.2.9",
            "v2026.2.6-3",
            "v2026.2.6-2",
            "v2026.2.6-1",
            "v2026.2.6",
            "v2026.2.3",
            "v2026.2.2",
            "v2026.2.1",
            "v2026.1.30",
            "v2026.1.29",
            "v2026.1.24-1",
            "v2026.1.24",
            "v2026.1.23",
            "v2026.1.22",
            "v2026.1.21",
            "v2026.1.20",
            "v2026.1.16-2",
            "v2026.1.15",
            "v2026.1.14-1",
            "v2026.1.13",
            "v2026.1.12-2",
            "v2026.1.12",
            "v2026.1.11-3",
            "v2026.1.11-2",
            "v2026.1.11-1",
            "v2026.1.11",
            "v2026.1.10",
            "v2026.1.9",
            "v2026.1.8",
            "v2026.1.5-3",
            "v2026.1.5-2",
            "v2026.1.5-1",
            "v2026.1.5",
            "v2.0.0-beta5",
            "v2.0.0-beta4",
            "v2.0.0-beta3",
            "v2.0.0-beta2",
            "v2.0.0-beta1",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53815.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.367619865Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53815.json",
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-q7q8-3mgw-q67r",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53815",
        "https://www.vulncheck.com/advisories/openclaw-channel-allowlist-bypass-in-message-read-actions",
        "https://github.com/openclaw/openclaw"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53815.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53815",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517975,
  "published_at": "2026-06-11T20:08:52.351+00:00"
}