p PatchFirst

CVE-2026-53815

CVE-2026-53815 · OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.

CVSS 7.1 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.5.19: Affected (semver)
    • 2026.5.19: Not affected (semver)

    Update to 2026.5.19

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.5.19

    Update to 2026.5.19

Original sources

Check your server →