Openclaw CVE-2026-35647

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-accessible vulnerability requiring no privileges or user interaction, with low attack complexity. The integrity impact is limited (I:L), meaning successful exploitation results in unauthorized message delivery rather than data modification or system compromise. The score of 5.3 represents a medium-severity baseline. Real-world risk is elevated by the lack of authentication requirements (PR:N), making exploitation broadly accessible; however, the limited scope (S:U, no cross-boundary impact) and absence of confidentiality or availability impact constrain the damage potential. The vulnerability is primarily a policy enforcement bypass rather than a security boundary violation. No EPSS score, CISA KEV status, or public exploit code availability was provided in the input data, limiting automated exploitation probability assessment. From an SSVC perspective, this is a compliance and user privacy issue rather than a critical technical impact scenario.

An unauthenticated attacker can craft and send verification notices to OpenClaw users, bypassing the configured direct message policies that would normally prevent contact from unpaired or unauthorized peers. For example, a user with strict DM restrictions allowing only whitelisted contacts can be reached by an attacker via a spoofed or manipulated verification notice, potentially enabling social engineering, spam, or account enumeration attacks. No public exploit code has been identified at time of analysis, and no active exploitation signals are present in the provided data.