CVE-2026-34507

5.4 Moyenne

Publiée le 29/05/2026 à 18:16 · Modifiée le 21/07/2026 à 17:10 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.3 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/openclaw/openclaw/security/advisories/GHSA-w4v6-g3wm-w36c MitigationVendor Advisory
https://www.vulncheck.com/advisories/openclaw-policy-bypass-in-qqbot-admin-commands-via-dm-only-and-allowfrom-checks Third Party Advisory

CVE-2026-34507

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs