CVE-2026-35622: OpenClaw auth bypass

CISO Take

OpenClaw before version 2026.3.22 contains an authentication bypass in its Google Chat webhook handler that allows any low-privileged attacker to supply an out-of-scope add-on principal and execute unauthorized actions through the AI agent's Google Chat integration. While attack complexity is rated high, the vulnerability requires no user interaction and EPSS places it in the top 79th percentile for exploitation likelihood — an unusually elevated signal for a medium-severity CVE. In agentic architectures where OpenClaw orchestrates downstream tools, the blast radius extends beyond the chat integration to any capability the agent can invoke, including data queries and workflow executions. Organizations should upgrade to OpenClaw 2026.3.22 immediately using the referenced patches; if patching is not possible, disable the Google Chat webhook endpoint and audit webhook logs for principals outside your intended deployment bindings.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity (CVSS 5.9) with HIGH attack complexity that constrains opportunistic exploitation, but the 79th percentile EPSS score indicates real attacker interest. Integrity impact is rated HIGH while confidentiality is LOW, meaning successful exploitation primarily enables unauthorized execution rather than data theft. With only 4 downstream dependents, organizational blast radius is limited today, but the 396 historical CVEs in this package ecosystem suggest a pattern of security debt. No public exploit or Nuclei template exists, and CISA has not added this to KEV. The combination of network-accessible attack vector, no user interaction requirement, and targeting of AI agent control channels makes this higher priority than the CVSS score alone suggests for organizations actively deploying OpenClaw.

How does the attack unfold?

Endpoint Discovery

Attacker identifies an OpenClaw deployment with the Google Chat integration enabled and locates the exposed app-url webhook endpoint through active scanning or public documentation.

AML.T0006

Principal Spoofing

Attacker crafts a webhook request supplying a valid Google Chat add-on principal that is not bound to the victim's OpenClaw deployment, exploiting the missing binding verification (CWE-290).

AML.T0091.000

Authentication Bypass

OpenClaw accepts the non-deployment principal as authenticated and grants the attacker access to the Google Chat integration channel as if they were a legitimate deployment caller.

AML.T0049

Unauthorized Agent Execution

Attacker issues commands through the authenticated session, causing the OpenClaw AI agent to invoke tools, execute workflows, or query internal data sources without legitimate authorization.

AML.T0053

Endpoint Discovery

Attacker identifies an OpenClaw deployment with the Google Chat integration enabled and locates the exposed app-url webhook endpoint through active scanning or public documentation.

AML.T0006

Principal Spoofing

Attacker crafts a webhook request supplying a valid Google Chat add-on principal that is not bound to the victim's OpenClaw deployment, exploiting the missing binding verification (CWE-290).

AML.T0091.000

Authentication Bypass

OpenClaw accepts the non-deployment principal as authenticated and grants the attacker access to the Google Chat integration channel as if they were a legitimate deployment caller.

AML.T0049

Unauthorized Agent Execution

Attacker issues commands through the authenticated session, causing the OpenClaw AI agent to invoke tools, execute workflows, or query internal data sources without legitimate authorization.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I High

A None

What should I do?

6 steps

Upgrade OpenClaw to version 2026.3.22 or later (apply commits 630f1479c44f and a47722de7e3c).
If immediate patching is not possible, disable or block the Google Chat app-url webhook endpoint at the network or application layer.
Audit webhook access logs for authentication events where principals do not match your expected deployment binding — flag any add-on principals outside your Google Workspace app deployment.
Apply network-level controls restricting webhook endpoint access to documented Google Chat source IP ranges.
Review and tighten OpenClaw agent tool permissions using least-privilege; minimize what an unauthorized webhook caller could trigger.
Rotate any credentials or API keys that the OpenClaw agent has access to if exploitation cannot be ruled out.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system — cybersecurity requirements

ISO 42001

A.6.2.6 - AI system security — authentication of integration components

NIST AI RMF

MANAGE-2.4 - Risks and related impacts of AI systems are mitigated through access controls and authentication

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35622?

OpenClaw before version 2026.3.22 contains an authentication bypass in its Google Chat webhook handler that allows any low-privileged attacker to supply an out-of-scope add-on principal and execute unauthorized actions through the AI agent's Google Chat integration. While attack complexity is rated high, the vulnerability requires no user interaction and EPSS places it in the top 79th percentile for exploitation likelihood — an unusually elevated signal for a medium-severity CVE. In agentic architectures where OpenClaw orchestrates downstream tools, the blast radius extends beyond the chat integration to any capability the agent can invoke, including data queries and workflow executions. Organizations should upgrade to OpenClaw 2026.3.22 immediately using the referenced patches; if patching is not possible, disable the Google Chat webhook endpoint and audit webhook logs for principals outside your intended deployment bindings.

Is CVE-2026-35622 actively exploited?

No confirmed active exploitation of CVE-2026-35622 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35622?

1. Upgrade OpenClaw to version 2026.3.22 or later (apply commits 630f1479c44f and a47722de7e3c). 2. If immediate patching is not possible, disable or block the Google Chat app-url webhook endpoint at the network or application layer. 3. Audit webhook access logs for authentication events where principals do not match your expected deployment binding — flag any add-on principals outside your Google Workspace app deployment. 4. Apply network-level controls restricting webhook endpoint access to documented Google Chat source IP ranges. 5. Review and tighten OpenClaw agent tool permissions using least-privilege; minimize what an unauthorized webhook caller could trigger. 6. Rotate any credentials or API keys that the OpenClaw agent has access to if exploitation cannot be ruled out.

What systems are affected by CVE-2026-35622?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Chat-integrated agent deployments, Webhook-driven automation pipelines.

What is the CVSS score for CVE-2026-35622?

CVE-2026-35622 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksChat-integrated agent deploymentsWebhook-driven automation pipelines

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals outside intended deployment bindings. Attackers can bypass webhook authentication by providing non-deployment add-on principals to execute unauthorized actions through the Google Chat integration.

Exploitation Scenario

An attacker with low-privilege access to a Google Workspace environment identifies an OpenClaw deployment with the Google Chat integration enabled by enumerating the app-url webhook endpoint. They craft a POST request to the OpenClaw webhook handler, supplying a valid Google Chat add-on principal that is not bound to the victim's OpenClaw deployment. Because OpenClaw fails to verify that the presented principal falls within intended deployment bindings (CWE-290), it accepts the request as authenticated. The attacker then issues commands through this authenticated session — triggering AI agent tool invocations such as querying internal data repositories, executing automated workflows, or invoking downstream APIs — without holding any legitimate authorization within the victim's deployment.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.