Loading vulnerability…
OpenClaw QQBot Slash Command Authorization Bypass
OpenClaw versions before 2026.4.27 contain an incorrect authorization vulnerability in QQBot pre-dispatch slash-command handling. Slash commands may be processed before the configured allowFrom policy is evaluated, allowing senders that the policy would otherwise block to trigger command handling. The practical effect depends on the Gateway operator's configuration and the commands or tools exposed through the QQBot path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A blocked sender may bypass configured allowFrom restrictions and invoke QQBot slash-command handling. This can result in unauthorized execution of actions available through exposed commands or tools, with integrity impact determined by the Gateway configuration. No confidentiality or availability impact is specified.
If you can’t patch tonight, do this now.
Until patched, restrict exposure of QQBot and its slash-command functionality; limit channel and tool allowlists to authorized users; avoid sharing a Gateway among mutually untrusted users; and disable the QQBot feature if it is not required.
Patch, then assume compromise.
Upgrade the npm openclaw package to version 2026.4.27 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.