CVE-2026-53837
LOWOpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers
Title source: cnaDescription
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-gp79-m99v-gjmh)
https://github.com/openclaw/openclaw/security/advisories/GHSA-gp79-m99v-gjmh
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers
https://www.vulncheck.com/advisories/openclaw-missing-channel-type-validation-in-mattermost-event-handlers
Scores
CVSS v3
3.7
EPSS
0.0019
EPSS Percentile
8.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-636
Status
published
Products (3)
OpenClaw/OpenClaw
< 2026.5.6
openclaw/openclaw
< 2026.5.6
OpenClaw/OpenClaw
2026.5.6
Published
Jun 12, 2026
Tracked Since
Jun 13, 2026