Which versions of OpenClaw are affected by CVE-2026-35630?

OpenClaw QQBot contains a critical authorization flaw (CVE-2026-35630, CVSS 7.5) that allows users to bypass approval workflows and execute previously-gated commands and plugins.. A patch is available.

How to fix or mitigate CVE-2026-35630?

24 hours: Identify all OpenClaw QQBot deployments and document which workflows depend on native approval buttons; contact OpenClaw support for patch availability timeline. 7 days: Restrict approval request access to verified approvers using role-based controls, disable the native approval button UI if feasible, and enable detailed audit logging of all approval actions. 30 days: Upgrade to OpenClaw QQBot version 2026.5.18 or later upon patch availability; verify approval workflow integrity post-upgrade.

OpenClaw CVE-2026-35630

Q: What is the CVSS score of CVE-2026-35630?

CVE-2026-35630 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33335 HIGH

Missing Authorization (CWE-862)

2026-05-29 disclosure@vulncheck.com

GHSA-hx4v-668p-g2qr

GHSA-mgq6-vr84-7m2j

Authentication Bypass Openclaw

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 17:02 EUVD

Analysis Generated

May 29, 2026 - 16:52 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

AnalysisAI

Authorization bypass in OpenClaw QQBot before 2026.5.18 allows non-approver users to resolve pending exec and plugin approval requests by clicking native approval buttons, because the configured approver identity is not enforced server-side. The flaw collapses a core access-control gate around command and plugin execution workflows, and no public exploit identified at time of analysis, though the GitHub Security Advisory GHSA-mgq6-vr84-7m2j and VulnCheck advisory provide enough detail to reproduce.

Technical ContextAI

OpenClaw integrates with QQBot to surface interactive approval buttons in chat for high-privilege actions such as executing commands ('exec') or invoking plugins. The system is supposed to honor an allowlist of configured approver identities, but the button-handler code path omits the check that ties the clicking user's QQ identity to the approver allowlist, so any participant who can see the button can resolve the request. This is a textbook CWE-862 Missing Authorization defect: the authentication of the actor is fine, but the authorization decision that should map actor-to-permission is absent at the trust boundary where the approval state machine transitions from 'pending' to 'approved'.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.18 or later, which adds enforcement of the configured approver identity on the button-handler path, per GHSA-mgq6-vr84-7m2j (https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons). If patching is not immediately possible, disable the QQBot native approval-button feature and fall back to a command-based approval flow that can be wrapped with an identity check, or restrict QQBot membership to only the approver account so no untrusted user can click the button - the trade-off is loss of multi-user visibility into pending requests and reduced UX convenience for legitimate approvers. As a further compensating control, audit recent exec and plugin approval events for resolutions attributed to non-approver identities while the upgrade is rolled out.