Is there a patch available for CVE-2026-35642?

Yes, a patch is available for CVE-2026-35642. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35642

Q: What is the CVSS score of CVE-2026-35642?

CVE-2026-35642 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21138 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-09 VulnCheck

GHSA-3grx-cg6p-5wc6

Authentication Bypass Openclaw

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21138

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

Patch released

Apr 09, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 09, 2026 - 21:27 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.24.

DescriptionCVE.org

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger reactions in mention-gated groups to enqueue agent-visible system events that should remain restricted.

AnalysisAI

OpenClaw before version 2026.3.25 allows authenticated attackers to bypass authorization controls in mention-gated groups by triggering reaction events that circumvent the requireMention access control mechanism, enabling them to enqueue agent-visible system events that should remain restricted. This medium-severity vulnerability (CVSS 5.3) affects the integrity of group-based access policies and requires user interaction at the network level but leverages low privilege requirements.

Technical ContextAI

OpenClaw implements group-based access control through a requireMention mechanism intended to restrict certain operations to explicitly mentioned participants. The vulnerability exists in the group reaction event handler, which fails to properly enforce this authorization check when processing reaction events. This is classified as CWE-288 (Authentication Using an Incorrect Unified Resource Identifier - URI), indicating a fundamental flaw in how the access control decision is made. The root cause appears to be that reaction event processing follows a different code path than other group operations, bypassing the standard requireMention validation. Attackers with low privilege access (PR:L) can exploit this to generate system events visible to agents that should only be accessible to mention-gated members.

RemediationAI

Upgrade OpenClaw to version 2026.3.25 or later, which contains the patch implementing proper authorization checks in group reaction event handling. The upstream fix is available via GitHub commit f8c98630785288cc1f1d0893503ef3b653a3cede. Users unable to upgrade immediately should restrict low-privilege user access to groups where mention-gating is critical for security policy enforcement, and monitor system event logs for unauthorized reaction events in sensitive groups. Consult the official security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-mw7w-g3mg-xqm7 for implementation details and additional guidance.