Is there a patch available for CVE-2026-35667?

Yes, a patch is available for CVE-2026-35667. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35667

Q: What is the CVSS score of CVE-2026-35667?

CVE-2026-35667 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21480 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-04-10 VulnCheck

Information Disclosure Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 16:30 euvd

EUVD-2026-21480

Analysis Generated

Apr 10, 2026 - 16:30 vuln.today

CVE Published

Apr 10, 2026 - 16:03 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.24.

DescriptionCVE.org

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers can trigger process termination via the !stop command, causing data corruption, resource leaks, and skipped security-sensitive cleanup operations.

AnalysisAI

OpenClaw before version 2026.3.24 permits authenticated local attackers to trigger improper process termination via the !stop chat command, which uses an unpatched killProcessTree function that sends SIGKILL without graceful SIGTERM shutdown. This incomplete fix for CVE-2026-27486 enables attackers to corrupt data, leak resources, and skip security-sensitive cleanup operations, resulting in integrity compromise and denial of service.

Technical ContextAI

The vulnerability stems from CWE-404 (Improper Resource Validation), specifically in the shell-utils.ts module's killProcessTree function. The function immediately sends SIGKILL signals to processes without first attempting a graceful SIGTERM shutdown sequence. In Unix/Linux process management, SIGTERM allows processes to catch the signal and execute cleanup handlers (flushing buffers, closing file handles, releasing locks), whereas SIGKILL terminates immediately without any opportunity for cleanup. The !stop chat command in OpenClaw exposes this function to authenticated users, allowing them to invoke the flawed process termination logic. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* identifies all versions of OpenClaw as potentially affected until patching.

RemediationAI

Vendor-released patch: OpenClaw version 2026.3.24 and later. Users must upgrade to 2026.3.24 or newer to obtain the corrected killProcessTree function that performs graceful SIGTERM shutdown before escalating to SIGKILL. No workarounds are available that mitigate the underlying flaw; patching is mandatory. Review the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2 for verification of patch completeness and any additional context regarding CVE-2026-27486 remediation.