CVE-2026-35637

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-696

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-356388.8OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain selCVE-2026-356398.8OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing apCVE-2026-35649.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authenticatCVE-2026-356407.5OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resouCVE-2026-356417.8OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to CVE-2026-356424.3OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access controCVE-2026-356438.8OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructiCVE-2026-356446.5OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentiCVE-2026-356458.8OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that CVE-2026-356466.5OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers toCVE-2026-356475.3OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired CVE-2026-356485.9OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command polic
CVE-2026-35637: High severity, CVSS 7.3 | Vulnix