{"id":"CVE-2026-53851","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-06-16T19:17:02.327","lastModified":"2026-10-25T23:10:00.167","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input."},{"lang":"es","value":"OpenClaw anterior a 2026.5.12 contiene una vulnerabilidad de omisión de notificaciones que permite que los eventos de reacción de Slack entren en la canalización del agente a pesar de tener las notificaciones de reacción deshabilitadas. Los atacantes pueden desencadenar un procesamiento no intencionado del agente al enviar eventos de reacción cuando la característica está habilitada, lo que podría llevar a un procesamiento no autorizado de entradas de menor confianza."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.5.12","versionType":"semver","status":"affected"},{"version":"2026.5.12","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-16T18:42:26.787784Z","id":"CVE-2026-53851","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.5.12","matchCriteriaId":"DE7E74F5-925B-4DC3-AFAF-9C0CAD4AADE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta1:*:*:*:node.js:*:*","matchCriteriaId":"B2F3E79D-C148-461C-9C28-9CAC44DA9C79"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta2:*:*:*:node.js:*:*","matchCriteriaId":"707AED9D-DA43-49D7-B7F4-59A191E84F7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta3:*:*:*:node.js:*:*","matchCriteriaId":"0A703002-3775-4DD0-AA4A-14A80C966009"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta4:*:*:*:node.js:*:*","matchCriteriaId":"A4100ECD-456B-46C7-89A5-ECB2AF5ACAE4"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta5:*:*:*:node.js:*:*","matchCriteriaId":"49121842-6A84-4C19-8465-A93C67B2FB32"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta6:*:*:*:node.js:*:*","matchCriteriaId":"18698933-5F61-484F-88EB-D14A0C684FF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta7:*:*:*:node.js:*:*","matchCriteriaId":"471D48FA-A3F4-4DC0-A46D-16FBAAB9A3BD"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.5.12:beta8:*:*:*:node.js:*:*","matchCriteriaId":"2543F40A-7360-496F-9F12-38D9B9B9291A"}]}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}