CVE-2026-53851
Full vulnerability record from the local CVENow database.
Description
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-16 19:17:02.327000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-53851",
"sourceIdentifier": "[email protected]",
"published": "2026-06-16T19:17:02.327",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input."
},
{
"lang": "es",
"value": "OpenClaw anterior a 2026.5.12 contiene una vulnerabilidad de omisión de notificaciones que permite que los eventos de reacción de Slack entren en la canalización del agente a pesar de tener las notificaciones de reacción deshabilitadas. Los atacantes pueden desencadenar un procesamiento no intencionado del agente al enviar eventos de reacción cuando la característica está habilitada, lo que podría llevar a un procesamiento no autorizado de entradas de menor confianza."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "OpenClaw",
"product": "OpenClaw",
"defaultStatus": "unaffected",
"repo": "https://github.com/openclaw/openclaw",
"packageURL": "pkg:npm/openclaw",
"versions": [
{
"version": "0",
"lessThan": "2026.5.12",
"versionType": "semver",
"status": "affected"
},
{
"version": "2026.5.12",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-16T18:42:26.787784Z",
"id": "CVE-2026-53851",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2026.5.12",
"matchCriteriaId": "DE7E74F5-925B-4DC3-AFAF-9C0CAD4AADE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta1:*:*:*:node.js:*:*",
"matchCriteriaId": "B2F3E79D-C148-461C-9C28-9CAC44DA9C79"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta2:*:*:*:node.js:*:*",
"matchCriteriaId": "707AED9D-DA43-49D7-B7F4-59A191E84F7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta3:*:*:*:node.js:*:*",
"matchCriteriaId": "0A703002-3775-4DD0-AA4A-14A80C966009"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta4:*:*:*:node.js:*:*",
"matchCriteriaId": "A4100ECD-456B-46C7-89A5-ECB2AF5ACAE4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta5:*:*:*:node.js:*:*",
"matchCriteriaId": "49121842-6A84-4C19-8465-A93C67B2FB32"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta6:*:*:*:node.js:*:*",
"matchCriteriaId": "18698933-5F61-484F-88EB-D14A0C684FF0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta7:*:*:*:node.js:*:*",
"matchCriteriaId": "471D48FA-A3F4-4DC0-A46D-16FBAAB9A3BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.5.12:beta8:*:*:*:node.js:*:*",
"matchCriteriaId": "2543F40A-7360-496F-9F12-38D9B9B9291A"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}