CVE-2026-53837
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
OpenClaw before version 2026.5.6 has an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass DM policy by sending crafted events missing channel type information to process restricted content.
Risk Assessment
An attacker can access content intended only for direct messages, compromising communication confidentiality.
Recommendation
Update OpenClaw to version 2026.5.6 or later, which includes the channel metadata validation fix.
Original NVD description (English source)
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.