PT-2026-31963 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35652

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains an authorization bypass in interactive callback dispatch. Non-allowlisted senders can execute action handlers by dispatching callbacks before security validation is complete, bypassing sender authorization checks. This allows unauthorized actions.

Recommendations Update to version 2026.3.22 or later.

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-696

CWE-863

Related Identifiers

CVE-2026-35652

GHSA-8883-9W57-VWV6

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 · Patch
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8883-9w57-vwv6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35652 · Security Note
• https://osv.dev/vulnerability/GHSA-8883-9w57-vwv6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042710262285771257 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unauthorized-action-execution-via-callback-dispatch · Note