Openclaw CVE-2026-35621

OpenClaw before version 2026.3.24. Attacker requires authenticated access with operator.write scope. Exploitation leverages chat.send command to build internal command-authorized context, then uses /allowlist command to mutate channel authorization policy (allowFrom/groupAllowFrom settings) normally restricted to operator.admin scope.

This privilege escalation presents moderate-to-significant real-world risk despite the moderate CVSS 6.5 score. The vulnerability requires authenticated access (PR:L in CVSS vector), but the attack complexity is low (AC:L), indicating straightforward exploitation once credentials are obtained. The integrity impact is high (I:H), enabling persistent unauthorized modifications to security-critical channel authorization policies. No confidentiality or availability impact exists (C:N/A:N), limiting the severity. The attack vector is network-based (AV:N) with no user interaction required (UI:N). Critically, this is a scope-limited vulnerability (S:U) affecting only the targeted resource authorization policies. The authorization bypass mechanism-leveraging chat.send to forge an internal command context-represents a design flaw rather than a simple validation gap, suggesting the risk may be underestimated by the base CVSS score. Organizations with OpenClaw deployments where operator.write accounts are more broadly distributed (compared to operator.admin accounts) face elevated risk of policy manipulation by compromised or malicious write-scoped operators.

An operator with operator.write scope (lower privilege level) can execute a chat.send command crafted to establish an internal command-authorized context that bypasses normal scope validation. The attacker then invokes the /allowlist command through this forged internal context to modify channel allowFrom and groupAllowFrom policies, effectively granting themselves operator.admin-level control over channel access without possessing the operator.admin scope. The policy changes persist, allowing the attacker to maintain unauthorized access or modify channel permissions for other clients. No public exploit code availability is noted in the provided intelligence, but the straightforward nature of the attack (low complexity) and clear authorization bypass mechanism suggest exploitation is readily achievable by an attacker with valid operator.write credentials.