CVE-2026-53851

Published: Jun 16, 2026Modified: Jun 17, 2026

6.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.

Affected (9)

Products: Openclaw: Openclaw

Openclaw

1 product

Openclaw

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openclaw Openclaw	Before 2026.5.12
Openclaw Openclaw	Version 2026.5.12 beta1
Openclaw Openclaw	Version 2026.5.12 beta2
Openclaw Openclaw	Version 2026.5.12 beta3
Openclaw Openclaw	Version 2026.5.12 beta4
Openclaw Openclaw	Version 2026.5.12 beta5
Openclaw Openclaw	Version 2026.5.12 beta6
Openclaw Openclaw	Version 2026.5.12 beta7
Openclaw Openclaw	Version 2026.5.12 beta8

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8

Source: disclosure@vulncheck.com

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass

Source: disclosure@vulncheck.com

Third Party Advisory

Timeline

No history available yet.