PT-2026-31758 · Google+1 · Google Chat+1

Ijxpwastaken · CVE-2026-35622 · Published 2026-03-26 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains an improper authentication verification issue in Google Chat app-url webhook handling. The application accepts add-on principals outside of intended deployment bindings, allowing attackers to bypass webhook authentication. By providing non-deployment add-on principals, attackers can execute unauthorized actions through the Google Chat integration.

Recommendations Update to version 2026.3.22 or later.

Exploit

Fix

Authentication Bypass by Spoofing

Incorrect Authorization

Weakness Enumeration

CWE-290

CWE-863

Related Identifiers

CVE-2026-35622

GHSA-HGWR-WR8H-RXM7

GHSA-MP66-RF4F-MHH8

Affected Products

Google Chat

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35622.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mp66-rf4f-mhh8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 · Patch
• https://osv.dev/vulnerability/GHSA-hgwr-wr8h-rxm7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp66-rf4f-mhh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35622 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-improper-authentication-verification-in-google-chat-webhook · Note
• https://twitter.com/CVEnew/status/2042561821140488513 · Twitter Post