CVE-2026-35630: OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons

Synopsis

OpenClaw before 2026.5.18 has an authorization bypass in the QQBot native approval buttons. The component fails to check that the clicking user matches the configured approver identity, so any low-privilege user with access to the chat can click an approval button to resolve a pending exec or plugin approval request. Successful exploitation lets unauthorized users approve arbitrary commands or plugin actions, compromising confidentiality, integrity, and availability of whatever the approved request executes. A patched-image rebuild at 2026.5.18 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the QQBot interface over the network, typically through the chat platform OpenClaw is integrated with.

• AuthenticationRequired

  A low-privilege account is sufficient: the attacker must be a user in the chat where approval buttons appear, but does not need approver privileges.

• Victim interactionRequired

  A legitimate user or automation must first submit an exec or plugin request that surfaces the approval buttons the attacker then clicks.

• Attack complexityDetail

  Exploitation is reliable once the conditions are met: clicking the button bypasses the identity check with no race or environmental dependencies, though the CVSS vector flags an attack requirement (AT:P).

Blast Radius

• Unauthorized users approve pending exec requests, causing OpenClaw to run arbitrary commands the attacker would not otherwise be permitted to run.
• Unauthorized users approve plugin actions, enabling tampering with plugin state and any systems those plugins reach.
• Approved exec or plugin actions can disrupt or take down the services OpenClaw orchestrates, depending on what the approved command does.