CVE-2026-53807
HIGHOpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom
Title source: cnaDescription
OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
patch
GitHub Security Advisory (GHSA-w5ww-7chg-mxcq)
https://github.com/openclaw/openclaw/security/advisories/GHSA-w5ww-7chg-mxcq
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-telegram-interactive-callbacks-via-commands-allowfrom
Scores
CVSS v3
8.8
EPSS
0.0031
EPSS Percentile
22.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-863
Status
published
Products (3)
OpenClaw/OpenClaw
< 2026.5.6
openclaw/openclaw
< 2026.5.6
OpenClaw/OpenClaw
2026.5.6
Published
Jun 11, 2026
Tracked Since
Jun 12, 2026