Openclaw CVE-2026-35645

The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H) indicates network-accessible privilege escalation requiring low-level authentication and low attack complexity, with high integrity and availability impact (VI:H, VA:H). The AT:P modifier (passive attack) combined with PR:L authentication requirement suggests this is not trivially exploitable by unauthenticated attackers, moderating the practical risk despite high integrity/availability impact. The CVSS score of 6.1 is appropriate for this class of vulnerability. Patch availability and vendor acknowledgment (indicated by GitHub security advisory and commit reference) confirm this is a recognized, addressable issue rather than a theoretical or unpatched zero-day. Real-world risk is moderate to high for organizations running vulnerable versions with untrusted user populations who possess low-privilege accounts, as the attack surface requires initial authentication foothold. Automation potential is high once access is obtained, making timely patching important.

An authenticated user with low-privilege account permissions (e.g., standard user or operator role) submits a request to the OpenClaw gateway that triggers the subagent fallback deleteSession function without a proper request-scoped client context. The vulnerable function instantiates a synthetic operator.admin scope instead of inheriting the user's actual privilege level, allowing the attacker to delete privileged sessions or modify protected data beyond their authorization. This requires prior authentication but no user interaction, making it feasible in automated attack chains or lateral movement scenarios post-compromise. No public exploit code is identified at the time of analysis, though the clear patch commit reference suggests the attack vector is well-understood by the vendor.