OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom
CVE-2026-53807

7.7HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
11 June 2026

What is CVE-2026-53807?

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.

Affected Version(s)

OpenClaw 0 < 2026.5.6

OpenClaw 2026.5.6

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisorypatch
https://www.vulncheck.com/advisories/openclaw-authorizati...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsx (@zsxsoft)
KeenSecurityLab
qclawer
.