{"id":"EUVD-2026-37153","enisaUuid":"d91d1ee8-6a18-336e-9a86-b3076025b372","description":"OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.","datePublished":"Jun 16, 2026, 6:05:00 PM","dateUpdated":"Jun 16, 2026, 6:55:36 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8\nhttps://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass\n","aliases":"CVE-2026-53851\nGHSA-c8w7-9w9h-x69q\nGHSA-fcvx-5cxc-v5p8\n","assigner":"VulnCheck","epss":0.19,"enisaIdProduct":[{"id":"768ee467-e3f0-356e-950c-498e97f85b4f","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.12"}],"enisaIdVendor":[{"id":"ef4dc09c-65c0-3c3d-9c51-3c0bfdddb1a1","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"69c32ab3-af4c-3651-8937-ceec0c586840","vulnerability":{"id":"CVE-2026-53851","description":"OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.","datePublished":"Jun 16, 2026, 6:05:00 PM","dateUpdated":"Jun 16, 2026, 6:55:36 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8\nhttps://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass\n","enisa_id":"EUVD-2026-37153\n","assigner":"VulnCheck","epss":0.19,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"6b59129e-2592-3bb2-8e72-d258674ec93b","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.12"}],"vulnerabilityVendor":[{"id":"32cd3042-f95e-3681-b182-e3510a2eea1d","vendor":{"name":"OpenClaw"}}]}},{"id":"aafc86e3-cc30-3374-9694-be7e20c8321c","vulnerability":{"id":"GHSA-c8w7-9w9h-x69q","description":"Duplicate Advisory: Slack reaction events could ignore reaction notification settings","datePublished":"Jun 16, 2026, 9:31:58 PM","dateUpdated":"Jun 18, 2026, 8:12:58 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53851\nhttps://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass\n","enisa_id":"EUVD-2026-37153\n","aliases":"GHSA-c8w7-9w9h-x69q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c80e2d3e-4f23-301f-9121-cadc09e0da48","vulnerability":{"id":"GHSA-fcvx-5cxc-v5p8","description":"OpenClaw: Slack reaction events could ignore reaction notification settings","datePublished":"Jun 18, 2026, 8:13:11 PM","dateUpdated":"Jun 18, 2026, 8:13:11 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53851\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-slack-reaction-event-notification-bypass\n","enisa_id":"EUVD-2026-37153\n","aliases":"GHSA-fcvx-5cxc-v5p8\nCVE-2026-53851\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}