OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-35630 · CVE overview and exploitation status

EUVD-2026-33335

GHSA-hx4v-668p-g2qr

GHSA-mgq6-vr84-7m2j

cve-program · CVE-2026-35630

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j
• https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons

euvd · EUVD-2026-33335

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j
• https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons

nvd · CVE-2026-35630

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j
• https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons

osv · GHSA-hx4v-668p-g2qr

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j
• https://nvd.nist.gov/vuln/detail/CVE-2026-35630
• https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons

osv · GHSA-mgq6-vr84-7m2j

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j
• https://nvd.nist.gov/vuln/detail/CVE-2026-35630
• https://github.com/openclaw/openclaw
• https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons

• OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin ap… · Advisory content revised · 11 Nov 2026