Is there a patch available for EUVD-2026-21444?

Yes, a patch is available for EUVD-2026-21444. Update the affected software to the latest version immediately.

Openclaw EUVD-2026-21444

Q: What is the CVSS score of EUVD-2026-21444?

EUVD-2026-21444 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35649 MEDIUM

Permissive List of Allowed Inputs (CWE-183)

2026-04-10 VulnCheck

Authentication Bypass Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 16:30 euvd

EUVD-2026-21444

Analysis Generated

Apr 10, 2026 - 16:30 vuln.today

Patch released

Apr 10, 2026 - 16:30 nvd

Patch available

CVE Published

Apr 10, 2026 - 16:03 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.

AnalysisAI

OpenClaw before version 2026.3.22 allows unauthenticated remote attackers to bypass access control denials by exploiting improper handling of empty allowlists during settings reconciliation, silently restoring previously revoked permissions. The vulnerability treats explicitly empty allowlists as unset rather than as explicit deny-all configurations, enabling attackers to undo intended access revocations without authentication. With a CVSS score of 6.5 and network-accessible attack vector, this represents a moderate-severity logic flaw affecting access control enforcement.

Technical ContextAI

OpenClaw's settings reconciliation mechanism fails to properly distinguish between an explicitly configured empty allowlist (intended to deny all access) and an unset or missing allowlist configuration. This is classified as CWE-183 (Unspecified Functionality), which encompasses improper handling of configuration state during system operations. The vulnerability lies in the authentication and authorization infrastructure, where the reconciliation process treats both states identically, causing the system to restore default or previously configured permissions when it should maintain the explicit deny-all stance. The affected product is identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, affecting all versions of OpenClaw up to and including 2026.3.22.

RemediationAI

Upgrade OpenClaw to version 2026.3.22 or later. Vendor-released patch is available; the upstream fixes are documented in GitHub commits 630f1479c44f78484dfa21bb407cbe6f171dac87 and 3cbf932413e41d1836cb91aed1541a28a3122f93. Organizations unable to immediately patch should audit their access control configurations to ensure deny-all allowlists are properly enforced at the application level rather than relying solely on settings reconciliation. Refer to the official GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-pw7h-9g6p-c378 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-settings-reconciliation-bypass-via-empty-allowlist for detailed mitigation guidance.