CVE-2026-53837

The record

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted content.

Affected packages

Related vulnerabilities

• CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
• CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636
• CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-636
• CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a… CWE-636
• CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor… CWE-636
• CVE-2026-46482 ### Impact The registration component does not validate the text-based _Security… CWE-636
• CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows… CWE-636
• CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-636