{"action":"Upgrade openclaw to 2026.4.29 or later.","affected":[{"fixed":"2026.4.29","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-34507"],"ecosystem":"npm","epss":0.00148,"exploited":false,"fixed_versions":["2026.4.29"],"ghsa_id":"GHSA-w4v6-g3wm-w36c","id":"tcs_01M5KGDXKGVHKZBPNRFSDTD58Q","modified_at":"2026-07-08T08:12:35.363358198Z","published_at":"2026-07-02T16:48:45Z","references":["https://osv.dev/vulnerability/GHSA-w4v6-g3wm-w36c","https://github.com/openclaw/openclaw/security/advisories/GHSA-w4v6-g3wm-w36c","https://github.com/openclaw/openclaw"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-w4v6-g3wm-w36c","url":"https://osv.dev/vulnerability/GHSA-w4v6-g3wm-w36c"},{"source":"nvd","source_id":"CVE-2026-34507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34507"}],"summary":"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy"}