CVE-2026-35624: OpenClaw auth bypass exposes

CISO Take

CVE-2026-35624 is a policy confusion flaw in OpenClaw's room authorization logic that compares room names instead of stable tokens, enabling a low-privileged attacker to create a room whose name collides with a protected room and gain unauthorized access to it. While CVSS scores this as medium (4.2) and attack complexity is rated high, the EPSS percentile sits in the top 85% of likely-to-be-exploited vulnerabilities — a meaningful signal that threat actors may be watching this class of flaw in AI agent collaboration platforms. The package has 396 other CVEs on record and a reported history of third-party skill abuse (AIID #1368), suggesting the OpenClaw ecosystem warrants elevated scrutiny in enterprise environments. Organizations running OpenClaw before 2026.3.22 integrated with Nextcloud Talk should patch immediately using the upstream commits (630f147, a47722d) and audit existing room allowlists for any name-based collision exposure.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Risk is moderate-low in isolation but elevated in context. CVSS 4.2 reflects limited scope (C:L/I:L, no availability impact) and high attack complexity. However, the EPSS 85th percentile indicates statistically above-average exploitation probability relative to the broader CVE population. The package's prior incident history (AIID #1368 — malicious skills delivering credential-stealing malware) and 396 CVEs in the same package increase the likelihood that threat actors already have familiarity with OpenClaw internals. The flaw targets authorization policy enforcement, a control that enterprise environments depend on to gate sensitive conversation data. In AI agent deployments where OpenClaw brokers access to Nextcloud Talk rooms containing model outputs, RAG context, or internal briefings, the effective blast radius exceeds what a CVSS 4.2 score implies.

How does the attack unfold?

Reconnaissance

Low-privileged attacker enumerates Nextcloud Talk room names via directory listing or prior access to identify high-value protected rooms.

AML.T0006

Resource Development

Attacker creates a new Nextcloud Talk room with a name engineered to collide with the target protected room under OpenClaw's name-matching logic.

AML.T0021

Initial Access / Bypass

OpenClaw's allowlist policy evaluator matches on room name instead of stable token, incorrectly granting the attacker access to the protected room.

AML.T0049

Impact

Attacker reads sensitive conversations, model outputs, or threat intelligence in the protected room, or injects messages consumed as trusted input by downstream AI agents.

AML.T0080

Reconnaissance

Low-privileged attacker enumerates Nextcloud Talk room names via directory listing or prior access to identify high-value protected rooms.

AML.T0006

Resource Development

Attacker creates a new Nextcloud Talk room with a name engineered to collide with the target protected room under OpenClaw's name-matching logic.

AML.T0021

Initial Access / Bypass

OpenClaw's allowlist policy evaluator matches on room name instead of stable token, incorrectly granting the attacker access to the protected room.

AML.T0049

Impact

Attacker reads sensitive conversations, model outputs, or threat intelligence in the protected room, or injects messages consumed as trusted input by downstream AI agents.

AML.T0080

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.22 or apply commits 630f1479 and a47722de directly.
Verify: After patching, confirm room authorization uses stable token comparison, not name matching — review any custom authorization wrappers built on top of OpenClaw's policy API.
Audit: Enumerate existing protected rooms and check for any rooms with similar or identical names that may have been used to stage the attack; revoke access for unexpected room members.
Detect: Query Nextcloud Talk audit logs for unexpected room join events by low-privileged accounts in protected rooms, particularly near rooms with similar names.
Harden: As a defense-in-depth measure, enforce room token rotation and avoid human-readable names as the sole access discriminator in allowlist policies.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0080 - AI Agent Context Poisoning AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

GOVERN 1.2 - Policies, processes, and procedures are in place for AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35624?

CVE-2026-35624 is a policy confusion flaw in OpenClaw's room authorization logic that compares room names instead of stable tokens, enabling a low-privileged attacker to create a room whose name collides with a protected room and gain unauthorized access to it. While CVSS scores this as medium (4.2) and attack complexity is rated high, the EPSS percentile sits in the top 85% of likely-to-be-exploited vulnerabilities — a meaningful signal that threat actors may be watching this class of flaw in AI agent collaboration platforms. The package has 396 other CVEs on record and a reported history of third-party skill abuse (AIID #1368), suggesting the OpenClaw ecosystem warrants elevated scrutiny in enterprise environments. Organizations running OpenClaw before 2026.3.22 integrated with Nextcloud Talk should patch immediately using the upstream commits (630f147, a47722d) and audit existing room allowlists for any name-based collision exposure.

Is CVE-2026-35624 actively exploited?

No confirmed active exploitation of CVE-2026-35624 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35624?

1. Patch: Upgrade OpenClaw to version 2026.3.22 or apply commits 630f1479 and a47722de directly. 2. Verify: After patching, confirm room authorization uses stable token comparison, not name matching — review any custom authorization wrappers built on top of OpenClaw's policy API. 3. Audit: Enumerate existing protected rooms and check for any rooms with similar or identical names that may have been used to stage the attack; revoke access for unexpected room members. 4. Detect: Query Nextcloud Talk audit logs for unexpected room join events by low-privileged accounts in protected rooms, particularly near rooms with similar names. 5. Harden: As a defense-in-depth measure, enforce room token rotation and avoid human-readable names as the sole access discriminator in allowlist policies.

What systems are affected by CVE-2026-35624?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, collaboration-integrated AI pipelines, multi-agent orchestration platforms.

What is the CVSS score for CVE-2026-35624?

CVE-2026-35624 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscollaboration-integrated AI pipelinesmulti-agent orchestration platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0080 AI Agent Context Poisoning

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: 6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.

Exploitation Scenario

An insider threat or compromised low-privileged account queries Nextcloud Talk to enumerate names of protected rooms visible in directory listings or via prior access. The attacker creates a new room with a name designed to collide with the target protected room's name under OpenClaw's matching logic. When OpenClaw's authorization evaluator processes an access request against the allowlist, it matches the attacker-controlled room name against the policy entry for the protected room and incorrectly grants access. The attacker now reads sensitive conversations, model outputs, or threat intelligence shared in the protected room — or injects messages that downstream AI agents consume as trusted input, potentially enabling context poisoning or misdirection of automated workflows.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.