Is there a patch available for CVE-2026-35657?

Yes, a patch is available for CVE-2026-35657. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35657

Q: What is the CVSS score of CVE-2026-35657?

CVE-2026-35657 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21460 HIGH

Incorrect Authorization (CWE-863)

2026-04-10 VulnCheck

Authentication Bypass Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 16:30 euvd

EUVD-2026-21460

Analysis Generated

Apr 10, 2026 - 16:30 vuln.today

Patch released

Apr 10, 2026 - 16:30 nvd

Patch available

CVE Published

Apr 10, 2026 - 16:03 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.

AnalysisAI

OpenClaw before version 2026.3.25 allows authenticated attackers to bypass authorization checks on the /sessions/:sessionKey/history HTTP endpoint, enabling unauthorized access to session history data without requiring operator.read scope permissions. The vulnerability affects all OpenClaw versions prior to 2026.3.25 and requires valid authentication credentials to exploit; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in OpenClaw's HTTP API authorization layer, specifically in the /sessions/:sessionKey/history route handler. The application implements a scope-based authorization model where the operator.read permission should gate access to session history data, but the endpoint fails to validate this scope requirement before returning sensitive session information. This represents a classic authorization bypass (CWE-863: Incorrect Authorization) where the authentication check exists but the authorization control is improperly implemented or skipped entirely. The affected product is identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covering all versions before the patched release.

RemediationAI

Vendor-released patch: Upgrade OpenClaw to version 2026.3.25 or later. The upstream fix has been committed to the repository (commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea) and is available in the patched release. Organizations unable to upgrade immediately should implement compensating network controls to restrict access to the /sessions/:sessionKey/history endpoint to only authenticated users who legitimately require operator.read permissions, and review access logs for unauthorized session history access patterns. Refer to the official GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j for additional technical details and the vendor patch link.