PT-2026-37020 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-17 · Updated 2026-05-05 · CVE-2026-43535

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.14

Description An authorization context reuse issue exists in collect-mode queue batches. This allows messages from different senders to inherit the authorization context of the final sender. An attacker can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, resulting in earlier messages executing with elevated permissions.

Recommendations Update to version 2026.4.14 or newer.

Fix

Incorrect Privilege Assignment

Incorrect Authorization

Weakness Enumeration

CWE-266

CWE-863

Related Identifiers

CVE-2026-43535

GHSA-JWRQ-8G5X-5FHM

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jwrq-8g5x-5fhm · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/43d4be902755c970b3d15608679761877718da69 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43535 · Security Note
• https://osv.dev/vulnerability/GHSA-jwrq-8g5x-5fhm · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/66024 · Note
• https://vulncheck.com/advisories/openclaw-authorization-context-reuse-in-collect-mode-queue-batches · Note
• https://t.me/CVEtracker/52735 · Telegram Post