Is there a patch available for CVE-2026-35664?

Yes, a patch is available for CVE-2026-35664. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35664

Q: What is the CVSS score of CVE-2026-35664?

CVE-2026-35664 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21474 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-10 VulnCheck

Authentication Bypass Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 16:30 euvd

EUVD-2026-21474

Analysis Generated

Apr 10, 2026 - 16:30 vuln.today

Patch released

Apr 10, 2026 - 16:30 nvd

Patch available

CVE Published

Apr 10, 2026 - 16:03 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.

AnalysisAI

OpenClaw before version 2026.3.25 contains an authentication bypass vulnerability in the raw card send surface that allows unauthenticated remote attackers to send malformed card commands, bypassing DM pairing restrictions and reaching callback handlers without proper authorization. This enables unpaired recipients to mint legacy callback payloads, resulting in integrity compromise of the messaging protocol. No public exploit code or active exploitation has been confirmed, but the low attack complexity and network accessibility make this a practical vulnerability.

Technical ContextAI

OpenClaw's card send functionality implements a Direct Messaging (DM) pairing mechanism intended to restrict callback payload generation to authorized paired recipients. The vulnerability stems from improper input validation in the raw card command parser (CWE-288: Authentication Bypass by Alternate Route), allowing attackers to craft specially-formed card commands that circumvent the pairing validation checks. The affected component processes callback payloads through a legacy pathway that does not enforce authentication state verification before executing callback handlers. This affects all versions of OpenClaw distributed via the cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* CPE identifier prior to version 2026.3.25.

RemediationAI

Vendor-released patch: OpenClaw version 2026.3.25 and later. Upgrade immediately to the patched version, which addresses the authentication bypass by implementing proper validation of card commands against the DM pairing state before callback payload processing. The upstream fix is available in commit 81c45976db532324b5a0918a70decc19520dc354 and corresponding tagged release. No interim workarounds are documented; patching is the primary remediation path. Refer to the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-77w2-crqv-cmv3 for detailed upgrade instructions and validation procedures.