PT-2026-31973 · Openclaw · Openclaw

Space08 · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35662

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description The issue involves a failure to enforce controlScope restrictions on the send action within OpenClaw. This allows leaf subagents to send messages to child sessions beyond their authorized scope, bypassing intended access control restrictions. The send action does not properly validate scope, enabling unauthorized communication with child sessions. The fix involves threading controller context through the send path and blocking send attempts unless the requester owns the target and has controlScope set to 'children'.

Recommendations Update to version 2026.3.22 or later.

Fix

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2026-35662

GHSA-X2CM-HG9C-MF5W

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7679eb375294941b02214c234aff3948796969d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35662 · Security Note
• https://osv.dev/vulnerability/GHSA-x2cm-hg9c-mf5w · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-missing-controlscope-enforcement-in-send-action · Note
• https://twitter.com/CVEnew/status/2042710249333768329 · Twitter Post