CVE-2026-35621: OpenClaw privilege escalation

CISO Take

OpenClaw before 2026.3.24 contains a missing authorization check (CWE-862) in its /allowlist command gateway, allowing any client with operator.write-scoped credentials to escalate to effective operator.admin privileges by exploiting chat.send to construct an internal command-authorized context and persist channel policy changes. The blast radius is currently limited — only 4 downstream dependents — but the attack path is low-complexity with no user interaction required over the network, and the CVE ranks in the top 82nd EPSS percentile, meaning it is statistically more likely to see exploitation than the vast majority of disclosed vulnerabilities. There is no public exploit and no CISA KEV listing at this time, keeping immediate urgency moderate. Patch to 2026.3.24 or later immediately; if patching is delayed, audit all channel allowFrom and groupAllowFrom policy entries against a known-good baseline and restrict /allowlist command access to operator.admin clients at the gateway layer.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The CVSS 6.5 Medium score understates the practical exploitability risk. AV:N/AC:L/PR:L/UI:N is a nearly frictionless attack path — any authenticated operator.write client on a network-reachable OpenClaw instance is a potential attacker. The integrity-only impact (C:N/I:H/A:N) is meaningful in an AI agent context because channel authorization policies directly govern what agents and callers are permitted to do. Persistent policy mutation is particularly dangerous as changes may go undetected across sessions. EPSS 82nd percentile elevates urgency beyond the raw CVSS number.

How does the attack unfold?

Initial Access

Attacker authenticates to the OpenClaw gateway using valid operator.write-scoped credentials, either legitimately issued or obtained via a compromised integration.

AML.T0012

Exploitation

Attacker sends crafted messages via chat.send to build an internal command-authorized context, triggering the /allowlist handler without triggering scope re-validation for internal callers.

AML.T0049

Persistence

Attacker modifies channel allowFrom and groupAllowFrom policies to add attacker-controlled client identifiers, persisting escalated access across gateway sessions beyond the initial exploit.

AML.T0081

Impact

Attacker retains ongoing operator.admin-equivalent control over channel authorization policy, enabling further privilege abuse, lateral movement to privileged agent operations, or whitelist expansion for follow-on attacks.

AML.T0053

Initial Access

Attacker authenticates to the OpenClaw gateway using valid operator.write-scoped credentials, either legitimately issued or obtained via a compromised integration.

AML.T0012

Exploitation

Attacker sends crafted messages via chat.send to build an internal command-authorized context, triggering the /allowlist handler without triggering scope re-validation for internal callers.

AML.T0049

Persistence

Attacker modifies channel allowFrom and groupAllowFrom policies to add attacker-controlled client identifiers, persisting escalated access across gateway sessions beyond the initial exploit.

AML.T0081

Impact

Attacker retains ongoing operator.admin-equivalent control over channel authorization policy, enabling further privilege abuse, lateral movement to privileged agent operations, or whitelist expansion for follow-on attacks.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.24 or later — the confirmed fixed release per vendor advisory.
Audit: Immediately review all channel allowFrom and groupAllowFrom policy entries; diff against your baseline configuration and revoke any unexpected entries.
Credential hygiene: Rotate operator.write-scoped credentials; apply least-privilege and do not issue operator.write to external or untrusted callers.
Detection: Enable logging on /allowlist command invocations and alert on any invocation originating from operator.write-scoped clients — this should not occur in a correctly operating deployment.
Temporary workaround: If patching is not immediately possible, restrict /allowlist handler access to operator.admin clients only at the gateway or network layer.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.6.1.3 - Access control for AI systems

NIST AI RMF

GOVERN 1.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35621?

OpenClaw before 2026.3.24 contains a missing authorization check (CWE-862) in its /allowlist command gateway, allowing any client with operator.write-scoped credentials to escalate to effective operator.admin privileges by exploiting chat.send to construct an internal command-authorized context and persist channel policy changes. The blast radius is currently limited — only 4 downstream dependents — but the attack path is low-complexity with no user interaction required over the network, and the CVE ranks in the top 82nd EPSS percentile, meaning it is statistically more likely to see exploitation than the vast majority of disclosed vulnerabilities. There is no public exploit and no CISA KEV listing at this time, keeping immediate urgency moderate. Patch to 2026.3.24 or later immediately; if patching is delayed, audit all channel allowFrom and groupAllowFrom policy entries against a known-good baseline and restrict /allowlist command access to operator.admin clients at the gateway layer.

Is CVE-2026-35621 actively exploited?

No confirmed active exploitation of CVE-2026-35621 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35621?

1. Patch: Upgrade OpenClaw to 2026.3.24 or later — the confirmed fixed release per vendor advisory. 2. Audit: Immediately review all channel allowFrom and groupAllowFrom policy entries; diff against your baseline configuration and revoke any unexpected entries. 3. Credential hygiene: Rotate operator.write-scoped credentials; apply least-privilege and do not issue operator.write to external or untrusted callers. 4. Detection: Enable logging on /allowlist command invocations and alert on any invocation originating from operator.write-scoped clients — this should not occur in a correctly operating deployment. 5. Temporary workaround: If patching is not immediately possible, restrict /allowlist handler access to operator.admin clients only at the gateway or network layer.

What systems are affected by CVE-2026-35621?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, multi-agent orchestration, agent gateway and access control layers, agentic pipelines with role-based scope enforcement.

What is the CVSS score for CVE-2026-35621?

CVE-2026-35621 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmulti-agent orchestrationagent gateway and access control layersagentic pipelines with role-based scope enforcement

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization policy. Attackers can exploit chat.send to build an internal command-authorized context and persist channel allowFrom and groupAllowFrom policy changes reserved for operator.admin scope.

Exploitation Scenario

An adversary obtains or is issued a legitimate operator.write-scoped API client for an OpenClaw deployment — potentially via a compromised integration or a low-trust third-party skill. They send a crafted sequence of messages via the chat.send channel to build an internal command-authorized execution context, exploiting the fact that the /allowlist handler does not re-validate gateway client scope for internal callers. Once the privileged context is established, the attacker issues /allowlist modifications to add attacker-controlled client identifiers or external endpoints to channel allowFrom and groupAllowFrom policies. These changes persist across sessions, giving the attacker ongoing access to operator.admin-equivalent channel authorization control — enabling them to whitelist additional malicious clients, expand the attack surface for subsequent skill-based abuse (as seen in AIID #1368), or pivot to privileged AI agent operations without ever holding admin credentials.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.