CVE-2026-35619: OpenClaw auth bypass exposes AI

CISO Take

OpenClaw's HTTP /v1/models endpoint fails to enforce operator read scope, allowing any authenticated user holding only the lower-privilege operator.approvals scope to enumerate gateway model metadata that should be restricted to privileged operators. Although severity is medium (CVSS 4.3) and no public exploit exists, EPSS places this in the top 81st percentile for exploitation likelihood, and the attack requires nothing beyond valid low-privilege credentials over the network with no user interaction required. With 396 other CVEs tracked in this package, OpenClaw represents a systemic risk concentration in AI agent gateway infrastructure, and leaked model metadata enables targeted reconnaissance for higher-impact follow-on attacks. Upgrade to OpenClaw 2026.3.24+ immediately (patch commit 06de515b) and audit all accounts holding operator.approvals scope; in the interim, block or rate-limit /v1/models at the perimeter WAF.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Elevated exploitability despite medium severity. The CVSS vector (AV:N/AC:L/PR:L/UI:N) means any network-reachable, low-privilege operator account can exploit this trivially without special tools or AI knowledge — a script-kiddie threshold. Impact is bounded to confidentiality of model metadata (C:L, no integrity or availability impact), but that metadata enables reconnaissance for higher-impact follow-on attacks against AI agent infrastructure. The 81st EPSS percentile and 396-CVE history in this package increase systemic risk of targeting OpenClaw deployments. The HTTP compatibility route as an authorization escape hatch is a design flaw that suggests broader audit of HTTP vs WebSocket parity is warranted.

How does the attack unfold?

Credential Access

Attacker obtains a low-privilege account with operator.approvals scope via credential stuffing, phishing a developer, or compromising a CI/CD service account integrated with the OpenClaw gateway.

AML.T0012

Authorization Bypass

Attacker sends an authenticated HTTP GET to /v1/models via the HTTP compatibility route, exploiting the missing scope enforcement that the WebSocket RPC interface would have enforced, gaining model listing access without operator read scope.

AML.T0049

AI Artifact Discovery

The unguarded endpoint returns full metadata for all registered AI gateway models — names, versions, endpoint identifiers, provider backends, and capability declarations — exposing the victim's complete deployed model inventory.

AML.T0007

Targeted Reconnaissance

Attacker leverages the enumerated model inventory to identify high-value LLM targets for follow-on attacks including model-specific prompt injection, jailbreaks, or exploitation of model-specific CVEs within the same AI agent infrastructure.

AML.T0013

Credential Access

Attacker obtains a low-privilege account with operator.approvals scope via credential stuffing, phishing a developer, or compromising a CI/CD service account integrated with the OpenClaw gateway.

AML.T0012

Authorization Bypass

Attacker sends an authenticated HTTP GET to /v1/models via the HTTP compatibility route, exploiting the missing scope enforcement that the WebSocket RPC interface would have enforced, gaining model listing access without operator read scope.

AML.T0049

AI Artifact Discovery

The unguarded endpoint returns full metadata for all registered AI gateway models — names, versions, endpoint identifiers, provider backends, and capability declarations — exposing the victim's complete deployed model inventory.

AML.T0007

Targeted Reconnaissance

Attacker leverages the enumerated model inventory to identify high-value LLM targets for follow-on attacks including model-specific prompt injection, jailbreaks, or exploitation of model-specific CVEs within the same AI agent infrastructure.

AML.T0013

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to 2026.3.24+ (patch commit 06de515b6c42816b62ec752e1c221cab67b38501 per vendor advisory GHSA-68f8-9mhj-h2mp).
Audit scope assignments: identify all accounts holding operator.approvals scope and confirm none require model enumeration capability; revoke or elevate as appropriate.
Workaround if patching is delayed: restrict /v1/models HTTP endpoint access at the reverse proxy or WAF layer to only connections presenting operator read scope tokens, or disable the HTTP compatibility route entirely if WebSocket RPC is sufficient.
Detection: query access logs for /v1/models HTTP requests from sessions lacking operator read scope and correlate with unusual downstream queries against enumerated model identifiers.
Audit HTTP vs WebSocket endpoint parity across all /v1/ routes for similar authorization gaps.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0007 - Discover AI Artifacts AML.T0013 - Discover AI Model Ontology AML.T0014 - Discover AI Model Family AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.3 - Access to AI system information

NIST AI RMF

GOVERN 1.1 - Policies and accountability for AI risk

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35619?

OpenClaw's HTTP /v1/models endpoint fails to enforce operator read scope, allowing any authenticated user holding only the lower-privilege operator.approvals scope to enumerate gateway model metadata that should be restricted to privileged operators. Although severity is medium (CVSS 4.3) and no public exploit exists, EPSS places this in the top 81st percentile for exploitation likelihood, and the attack requires nothing beyond valid low-privilege credentials over the network with no user interaction required. With 396 other CVEs tracked in this package, OpenClaw represents a systemic risk concentration in AI agent gateway infrastructure, and leaked model metadata enables targeted reconnaissance for higher-impact follow-on attacks. Upgrade to OpenClaw 2026.3.24+ immediately (patch commit 06de515b) and audit all accounts holding operator.approvals scope; in the interim, block or rate-limit /v1/models at the perimeter WAF.

Is CVE-2026-35619 actively exploited?

No confirmed active exploitation of CVE-2026-35619 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35619?

1. Patch immediately: upgrade OpenClaw to 2026.3.24+ (patch commit 06de515b6c42816b62ec752e1c221cab67b38501 per vendor advisory GHSA-68f8-9mhj-h2mp). 2. Audit scope assignments: identify all accounts holding operator.approvals scope and confirm none require model enumeration capability; revoke or elevate as appropriate. 3. Workaround if patching is delayed: restrict /v1/models HTTP endpoint access at the reverse proxy or WAF layer to only connections presenting operator read scope tokens, or disable the HTTP compatibility route entirely if WebSocket RPC is sufficient. 4. Detection: query access logs for /v1/models HTTP requests from sessions lacking operator read scope and correlate with unusual downstream queries against enumerated model identifiers. 5. Audit HTTP vs WebSocket endpoint parity across all /v1/ routes for similar authorization gaps.

What systems are affected by CVE-2026-35619?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, multi-model AI gateway deployments, model serving, API gateways for AI models.

What is the CVSS score for CVE-2026-35619?

CVE-2026-35619 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmulti-model AI gateway deploymentsmodel servingAPI gateways for AI models

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0013 Discover AI Model Ontology

AML.T0014 Discover AI Model Family

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model metadata through the HTTP compatibility route, bypassing the stricter WebSocket RPC authorization checks.

Exploitation Scenario

An attacker compromises or acquires a service account with minimal operator.approvals credentials — the lowest operator privilege tier in OpenClaw, potentially obtained via phishing or credential stuffing against a developer or CI/CD integration account. Rather than using the WebSocket RPC interface (which enforces stricter scope checks), the attacker sends an authenticated HTTP GET to /v1/models via the HTTP compatibility route, receiving a full inventory of registered AI gateway models with their metadata. Armed with the model names, version strings, and capability declarations, the attacker identifies specific LLM endpoints, their provider backends, and any capability flags. This reconnaissance informs targeted prompt injection campaigns, model-specific jailbreaks, or lateral movement by exploiting model-specific CVEs within the same AI agent infrastructure — using one low-severity bypass to enable a higher-impact second-stage attack.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.