PT-2026-31972 · Openclaw · Openclaw

Peng Zhou · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-35661

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypass DM pairing and modify session state.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-35661

Affected Products

Openclaw

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35661 · Security Note
• https://github.com/openclaw/openclaw/commit/269282ac69ab6030d5f30d04822668f607f13065 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33 · Note
• https://vulncheck.com/advisories/openclaw-telegram-dm-scoped-inline-button-callback-authorization-bypass · Note