CVE-2026-53837

OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers

State: Published
Severity: 6.3 Medium
Published: Jun 12, 2026
Updated: Jun 15, 2026
Reserved: Jun 10, 2026

Description

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-636 Not Failing Securely ('Failing Open')

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.5.6Affected 2026.5.6Not affected

References

GitHub Security Advisory (GHSA-gp79-m99v-gjmh)vendor-advisory
VulnCheck Advisory: OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlersthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.