CVE-2026-35620: OpenClaw missing authz enables

CISO Take

OpenClaw, an AI agent framework, contains missing authorization checks in its /send and /allowlist chat command handlers, allowing any user holding operator.write scope to permanently override session delivery policies and expand the trusted allowlist without the operator.admin privileges that should be required. The EPSS score places this in the top 65% of exploitable CVEs and attack complexity is low with no user interaction needed, making this practically exploitable by any authenticated operator in multi-user deployments — though the absence of a public exploit and CISA KEV listing moderates immediate mass exploitation risk. Configuration changes persist beyond individual sessions, meaning a single exploitation event can create a durable foothold for downstream prompt injection or agent output interception. Upgrade to OpenClaw 2026.3.24 immediately using the referenced patches; if patching is delayed, audit and restrict operator.write assignments and monitor /send and /allowlist command invocations in audit logs.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 5.4, I:L/A:L) with low attack complexity and no user interaction required. In practice, risk exceeds the score in multi-operator environments: a compromised or rogue operator.write credential is sufficient to persistently reconfigure session delivery and allowlists — changes that survive session termination and affect future interactions. The 396 other CVEs in the same package signal a persistently weak security posture for the OpenClaw project. Limited to 4 known downstream dependents reduces broad ecosystem exposure, but organizations running OpenClaw in enterprise or shared-operator contexts should treat this as a priority patch given the persistence characteristic and AI agent access scope involved.

How does the attack unfold?

Initial Access

Attacker obtains a valid operator.write credential through compromise, insider access, or over-provisioning — no elevated privilege required to begin the attack.

AML.T0012

Authorization Bypass

Attacker issues /send on|off|inherit to the vulnerable handler, overriding the session's sendPolicy without triggering any admin authorization check due to CWE-862.

AML.T0049

Configuration Persistence

Attacker executes /allowlist add to register attacker-controlled addresses in both config-backed and pairing-store allowlists, making the change durable across future sessions.

AML.T0081

Impact

Attacker's endpoint gains persistent ability to inject inputs into and receive outputs from the AI agent, enabling prompt injection, data exfiltration, or abuse of the agent's connected tool capabilities in all subsequent sessions.

AML.T0053

Initial Access

Attacker obtains a valid operator.write credential through compromise, insider access, or over-provisioning — no elevated privilege required to begin the attack.

AML.T0012

Authorization Bypass

Attacker issues /send on|off|inherit to the vulnerable handler, overriding the session's sendPolicy without triggering any admin authorization check due to CWE-862.

AML.T0049

Configuration Persistence

Attacker executes /allowlist add to register attacker-controlled addresses in both config-backed and pairing-store allowlists, making the change durable across future sessions.

AML.T0081

Impact

Attacker's endpoint gains persistent ability to inject inputs into and receive outputs from the AI agent, enabling prompt injection, data exfiltration, or abuse of the agent's connected tool capabilities in all subsequent sessions.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A Low

What should I do?

1 step

1) Upgrade OpenClaw to 2026.3.24 or later — patches are available in commits ccfeecb6887c, ea018a68ccb9, and 555b2578a8cc referenced in the vendor advisories. 2) If patching is delayed: audit all accounts with operator.write scope and reduce assignments to minimum required; review and reset current sendPolicy and allowFrom/pairing-store allowlist entries for any unauthorized modifications. 3) Enable audit logging for /send and /allowlist command invocations and alert on invocations from non-admin principals. 4) For production deployments handling sensitive data, consider temporarily restricting operator.write users to read-only scope until the patch is applied. 5) After patching, rotate any operator credentials that were active during the vulnerability window.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2.2 - Roles and responsibilities for AI systems

NIST AI RMF

GOVERN 1.2 - Organizational accountability for AI risk

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35620?

OpenClaw, an AI agent framework, contains missing authorization checks in its /send and /allowlist chat command handlers, allowing any user holding operator.write scope to permanently override session delivery policies and expand the trusted allowlist without the operator.admin privileges that should be required. The EPSS score places this in the top 65% of exploitable CVEs and attack complexity is low with no user interaction needed, making this practically exploitable by any authenticated operator in multi-user deployments — though the absence of a public exploit and CISA KEV listing moderates immediate mass exploitation risk. Configuration changes persist beyond individual sessions, meaning a single exploitation event can create a durable foothold for downstream prompt injection or agent output interception. Upgrade to OpenClaw 2026.3.24 immediately using the referenced patches; if patching is delayed, audit and restrict operator.write assignments and monitor /send and /allowlist command invocations in audit logs.

Is CVE-2026-35620 actively exploited?

No confirmed active exploitation of CVE-2026-35620 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35620?

1) Upgrade OpenClaw to 2026.3.24 or later — patches are available in commits ccfeecb6887c, ea018a68ccb9, and 555b2578a8cc referenced in the vendor advisories. 2) If patching is delayed: audit all accounts with operator.write scope and reduce assignments to minimum required; review and reset current sendPolicy and allowFrom/pairing-store allowlist entries for any unauthorized modifications. 3) Enable audit logging for /send and /allowlist command invocations and alert on invocations from non-admin principals. 4) For production deployments handling sensitive data, consider temporarily restricting operator.write users to read-only scope until the patch is applied. 5) After patching, rotate any operator credentials that were active during the vulnerability window.

What systems are affected by CVE-2026-35620?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, multi-tenant agent deployments, agent orchestration systems, RAG pipelines with agent front-ends.

What is the CVSS score for CVE-2026-35620?

CVE-2026-35620 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmulti-tenant agent deploymentsagent orchestration systemsRAG pipelines with agent front-ends

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session's sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization.

Exploitation Scenario

An attacker holding a compromised or legitimately over-provisioned operator.write credential connects to an OpenClaw deployment and issues /send on to enable session delivery to additional external endpoints — no admin prompt or approval is triggered due to the missing authorization check. They then issue /allowlist add <attacker-controlled-address> to register an external address as a trusted sender in both the config-backed and pairing-store allowlists, persisting the configuration across future sessions. In subsequent interactions, the attacker's endpoint can send crafted inputs to the AI agent and receive its outputs, enabling prompt injection to steer agent behavior, exfiltration of data accessible via the agent's tools, or use of the agent's tool invocation capabilities to interact with connected services — all without the victim's awareness that the allowlist has been silently expanded.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.