CVE-2026-35617: OpenClaw auth bypass

CISO Take

OpenClaw before 2026.3.25 enforces Google Chat group policies using mutable space display names rather than stable identifiers, allowing any low-privilege authenticated user to rebind access controls by renaming or creating a space with a colliding display name. While the CVSS score sits at medium (4.2), the EPSS places this in the top 86th percentile for exploitation likelihood — an unusually high signal for a medium-severity finding — and the package carries 396 other CVEs, indicating systemic security debt in this AI agent framework. The limited blast radius (4 downstream dependents, no CISA KEV, no public exploit) constrains broad exposure, but any organization running OpenClaw agent workflows against Google Workspace should treat this as urgent given the low privilege bar and zero user interaction required. Patch to 2026.3.25 or later immediately; if patching is delayed, restrict space rename permissions to admins via Google Workspace Admin Console and audit existing group policy assignments.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium CVSS (4.2) understates operational risk in AI agent deployments. The EPSS top-86th-percentile placement combined with a low-privilege requirement (PR:L) and no user interaction (UI:N) makes exploitation accessible without sophisticated tooling. High attack complexity (AC:H) provides partial mitigation — successful exploitation requires name collision or timing alignment — but this is feasible in any shared Google Workspace environment with multiple users. The package's 396-CVE history signals deep-seated code quality issues, increasing the probability of related bypasses emerging. Confidentiality and integrity impact are both limited (C:L/I:L), but in AI agent contexts where group policies gate access to sensitive data stores or privileged tool invocations, even partial access can have disproportionate downstream effects.

How does the attack unfold?

Initial Access

Attacker authenticates to the shared Google Workspace environment using a valid low-privilege account — no elevated credentials or special permissions required.

AML.T0012

Policy Discovery

Attacker enumerates Google Chat spaces visible to their account and identifies one whose display name matches an OpenClaw group policy guarding high-value agent resources.

AML.T0084

Policy Rebinding

Attacker renames their own Chat space or creates a new one with a display name identical to the policy-protected space, causing OpenClaw's policy resolution to bind the elevated policy to the attacker's context.

AML.T0081

Unauthorized Resource Access

OpenClaw enforces the spoofed group policy, granting the attacker unauthorized access to protected data stores, agent tool invocations, or confidential channel content intended only for authorized group members.

AML.T0053

Initial Access

Attacker authenticates to the shared Google Workspace environment using a valid low-privilege account — no elevated credentials or special permissions required.

AML.T0012

Policy Discovery

Attacker enumerates Google Chat spaces visible to their account and identifies one whose display name matches an OpenClaw group policy guarding high-value agent resources.

AML.T0084

Policy Rebinding

Attacker renames their own Chat space or creates a new one with a display name identical to the policy-protected space, causing OpenClaw's policy resolution to bind the elevated policy to the attacker's context.

AML.T0081

Unauthorized Resource Access

OpenClaw enforces the spoofed group policy, granting the attacker unauthorized access to protected data stores, agent tool invocations, or confidential channel content intended only for authorized group members.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to 2026.3.25 or later — commit 11ea1f67 resolves the issue by anchoring policies to stable, immutable space IDs rather than mutable display names.
Workaround if immediate patching is not possible: restrict 'rename space' permissions to trusted admins only via Google Workspace Admin Console > Apps > Google Chat settings.
Post-patch audit: review all existing group policy configurations and reapply any that were defined by display name to ensure they now reference stable identifiers.
Detection: monitor Google Workspace audit logs (Admin console > Reports > Audit > Google Chat) for unusual space renames or creation of spaces with names matching existing policy-protected spaces.
Strategic: the 396-CVE history in this package warrants a broader review of whether OpenClaw meets your agent framework security bar — evaluate alternative frameworks with stronger security track records for new deployments.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.8.4 - AI System Access Control

NIST AI RMF

GOVERN 1.2 - Accountability Structures for AI Risk

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-35617?

OpenClaw before 2026.3.25 enforces Google Chat group policies using mutable space display names rather than stable identifiers, allowing any low-privilege authenticated user to rebind access controls by renaming or creating a space with a colliding display name. While the CVSS score sits at medium (4.2), the EPSS places this in the top 86th percentile for exploitation likelihood — an unusually high signal for a medium-severity finding — and the package carries 396 other CVEs, indicating systemic security debt in this AI agent framework. The limited blast radius (4 downstream dependents, no CISA KEV, no public exploit) constrains broad exposure, but any organization running OpenClaw agent workflows against Google Workspace should treat this as urgent given the low privilege bar and zero user interaction required. Patch to 2026.3.25 or later immediately; if patching is delayed, restrict space rename permissions to admins via Google Workspace Admin Console and audit existing group policy assignments.

Is CVE-2026-35617 actively exploited?

No confirmed active exploitation of CVE-2026-35617 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35617?

1. Patch: upgrade OpenClaw to 2026.3.25 or later — commit 11ea1f67 resolves the issue by anchoring policies to stable, immutable space IDs rather than mutable display names. 2. Workaround if immediate patching is not possible: restrict 'rename space' permissions to trusted admins only via Google Workspace Admin Console > Apps > Google Chat settings. 3. Post-patch audit: review all existing group policy configurations and reapply any that were defined by display name to ensure they now reference stable identifiers. 4. Detection: monitor Google Workspace audit logs (Admin console > Reports > Audit > Google Chat) for unusual space renames or creation of spaces with names matching existing policy-protected spaces. 5. Strategic: the 396-CVE history in this package warrants a broader review of whether OpenClaw meets your agent framework security bar — evaluate alternative frameworks with stronger security track records for new deployments.

What systems are affected by CVE-2026-35617?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, enterprise messaging integrations, AI agent access control layers.

What is the CVSS score for CVE-2026-35617?

CVE-2026-35617 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksenterprise messaging integrationsAI agent access control layers

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.

Exploitation Scenario

A low-privilege insider or compromised employee account identifies a Google Chat space named 'IR-SecOps-Private' that carries an OpenClaw group policy granting agent access to a sensitive incident response data store and alerting tools. The attacker renames their personal workspace Chat space — or creates a new sandbox space — to 'IR-SecOps-Private', triggering a display name collision in OpenClaw's policy resolution logic. OpenClaw applies the elevated group policy to the attacker's context, granting unauthorized access to the incident response toolset. The attacker can now query agent tools, receive breaking security alerts, or read from the linked data store — all without ever touching the legitimate protected space or its member list.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.