Which versions of OpenClaw are affected by CVE-2026-35674?

OpenClaw versions prior to 2026.5.18 contain a privilege escalation vulnerability enabling authenticated users with limited operator permissions to gain full administrative control, allowing…. A patch is available.

How to fix or mitigate CVE-2026-35674?

24 hours: Audit OpenClaw user directory to identify all accounts with operator.write scope; document current privilege assignments. 7 days: Restrict operator.write scope to only essential trusted administrators; implement mandatory approvals for all configuration, plugin, MCP, and ACP changes; enable audit logging on chat.send API calls. 30 days: Upon vendor release of OpenClaw 2026.5.18 or later, apply patch immediately; conduct full access review, privilege re-certification, and audit any configuration changes made during exposure.

OpenClaw CVE-2026-35674

Q: What is the CVSS score of CVE-2026-35674?

CVE-2026-35674 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33337 HIGH

Incorrect Authorization (CWE-863)

2026-05-29 disclosure@vulncheck.com

GHSA-9wcx-q3fh-qg43

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 17:02 EUVD

Analysis Generated

May 29, 2026 - 16:51 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements, enabling unauthorized plugin, config, MCP, allowlist, and ACP mutations.

AnalysisAI

Scope bypass in OpenClaw versions prior to 2026.5.18 allows authenticated clients holding only the operator.write scope to invoke privileged Gateway commands via the chat.send route, escalating from limited operator access to full administrative control. Exploitation lets remote attackers mutate plugins, configuration, MCP settings, allowlists, and ACP rules that should require operator.approvals or operator.admin scopes. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 8.7 (high) and low attack complexity make this a serious privilege-escalation issue for any multi-tenant or delegated OpenClaw deployment.

Technical ContextAI

OpenClaw exposes a Gateway component that routes chat.send messages to backend command handlers, and is intended to enforce scope-based authorization (operator.write, operator.approvals, operator.admin) on those handlers. The root cause is classified as CWE-863 (Incorrect Authorization): the chat.send route inherits external route definitions, and the scope check on the inbound chat.send call is not re-applied to the inherited downstream handlers, so a token bearing only operator.write can reach commands gated for higher scopes. Affected functionality includes plugin management, configuration changes, MCP (Model Context Protocol) settings, allowlist management, and ACP (Agent/Access Control Policy) mutations - administrative surfaces that, when subverted, compromise the integrity of the entire OpenClaw instance.

RemediationAI

The primary fix is to upgrade OpenClaw to vendor-released patch 2026.5.18 or later, which corrects the scope inheritance on the Gateway chat.send route per the GHSA-hw9r-h9mr-4jff advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-hw9r-h9mr-4jff). If immediate upgrade is not possible, narrow the blast radius by revoking or tightening operator.write scope tokens so only fully trusted operators hold them (with the trade-off of breaking legitimate write integrations), and by blocking or proxy-filtering chat.send requests targeting plugin, config, MCP, allowlist, or ACP commands at an upstream gateway or reverse proxy (trade-off: requires deep request inspection and risks blocking legitimate chat traffic). Audit recent chat.send activity from operator.write tokens against plugin, allowlist, and ACP mutation logs to detect prior exploitation, and refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-scope-bypass-via-inherited-chat-send-route for additional indicators.