CVE-2026-35631: OpenClaw auth bypass on ACP

CISO Take

OpenClaw's internal Agent Control Plane (ACP) chat interface fails to enforce the `operator.admin` scope on mutating commands, meaning any authenticated low-privilege user can directly invoke admin-level control-plane operations and modify agent behavior or configuration without authorization. Despite no public exploit code, this vulnerability lands in the top 87th EPSS percentile — statistical models rate it significantly more likely to be exploited than the median CVE — and the OpenClaw ecosystem has an established history of active abuse (AIID #1368 documented malicious skills exfiltrating credentials via the same platform). The integrity-only impact (CVSS I:H) is deceptive in an AI agent context: an attacker silently reconfiguring agent workflows, injecting malicious skills, or altering system prompts can cause downstream harm far exceeding the medium CVSS score suggests. Upgrade to OpenClaw ≥ 2026.3.22 immediately; if patching is blocked, restrict ACP command endpoints to admin-only network segments and audit logs for mutating commands issued from non-admin accounts.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium CVSS (6.5) understates operational risk in AI agent deployments. The combination of network-accessible attack vector, low complexity, and only low-privilege required puts this within reach of any authenticated user — including compromised developer accounts or malicious insiders. The 87th EPSS percentile signals elevated exploitation probability relative to the full CVE population. The package carries 396 historical CVEs, indicating a high-frequency target with an active vulnerability research surface. The absence of a public exploit or scanner template provides temporary friction but is not a durable control given the trivial exploitation requirements. Multi-tenant or enterprise deployments where untrusted users share an OpenClaw instance face the highest exposure.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege OpenClaw account via credential stuffing, phishing, or insider access — no admin rights required.

AML.T0012

Discovery

Attacker enumerates ACP chat command endpoints to identify mutating operations and confirm which lack `operator.admin` scope enforcement.

AML.T0084

Exploitation

Attacker directly invokes mutating ACP commands over the network, bypassing the missing authorization gate on admin-scoped operations.

AML.T0049

Impact

Attacker modifies agent configuration, registers malicious skills, or alters control-plane state to establish persistence, exfiltrate data, or redirect agent behavior.

AML.T0081

Initial Access

Attacker obtains a low-privilege OpenClaw account via credential stuffing, phishing, or insider access — no admin rights required.

AML.T0012

Discovery

Attacker enumerates ACP chat command endpoints to identify mutating operations and confirm which lack `operator.admin` scope enforcement.

AML.T0084

Exploitation

Attacker directly invokes mutating ACP commands over the network, bypassing the missing authorization gate on admin-scoped operations.

AML.T0049

Impact

Attacker modifies agent configuration, registers malicious skills, or alters control-plane state to establish persistence, exfiltrate data, or redirect agent behavior.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A None

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥ 2026.3.22; review commits 630f1479c4 and 229426a257 to confirm the operator.admin scope is now enforced on all mutating ACP command handlers.
Network isolation (immediate workaround): Restrict ACP chat command endpoints to admin-only network segments or apply API gateway policies that reject mutating operations from non-admin sessions.
Detection: Query application logs for ACP mutating operations (CREATE, UPDATE, DELETE, SET, REGISTER) issued from non-admin account tokens; alert on any anomalous matches.
Access hygiene: Revoke OpenClaw access from accounts that do not require it; audit all active sessions and rotate credentials for low-privilege accounts that had recent ACP access.
Supply chain: If OpenClaw is consumed via pip in CI/CD pipelines, pin to ≥ 2026.3.22 and verify installed commits against the published patch before promoting to production.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.4 - AI system access control

NIST AI RMF

GOVERN 1.7 - Roles and responsibilities for AI risk management are documented

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35631?

OpenClaw's internal Agent Control Plane (ACP) chat interface fails to enforce the `operator.admin` scope on mutating commands, meaning any authenticated low-privilege user can directly invoke admin-level control-plane operations and modify agent behavior or configuration without authorization. Despite no public exploit code, this vulnerability lands in the top 87th EPSS percentile — statistical models rate it significantly more likely to be exploited than the median CVE — and the OpenClaw ecosystem has an established history of active abuse (AIID #1368 documented malicious skills exfiltrating credentials via the same platform). The integrity-only impact (CVSS I:H) is deceptive in an AI agent context: an attacker silently reconfiguring agent workflows, injecting malicious skills, or altering system prompts can cause downstream harm far exceeding the medium CVSS score suggests. Upgrade to OpenClaw ≥ 2026.3.22 immediately; if patching is blocked, restrict ACP command endpoints to admin-only network segments and audit logs for mutating commands issued from non-admin accounts.

Is CVE-2026-35631 actively exploited?

No confirmed active exploitation of CVE-2026-35631 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35631?

1. Patch: Upgrade to OpenClaw ≥ 2026.3.22; review commits 630f1479c4 and 229426a257 to confirm the `operator.admin` scope is now enforced on all mutating ACP command handlers. 2. Network isolation (immediate workaround): Restrict ACP chat command endpoints to admin-only network segments or apply API gateway policies that reject mutating operations from non-admin sessions. 3. Detection: Query application logs for ACP mutating operations (CREATE, UPDATE, DELETE, SET, REGISTER) issued from non-admin account tokens; alert on any anomalous matches. 4. Access hygiene: Revoke OpenClaw access from accounts that do not require it; audit all active sessions and rotate credentials for low-privilege accounts that had recent ACP access. 5. Supply chain: If OpenClaw is consumed via pip in CI/CD pipelines, pin to ≥ 2026.3.22 and verify installed commits against the published patch before promoting to production.

What systems are affected by CVE-2026-35631?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, multi-tenant AI deployments.

What is the CVSS score for CVE-2026-35631?

CVE-2026-35631 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration platformsmulti-tenant AI deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.4

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without admin privileges can execute mutating control-plane actions by directly invoking affected ACP commands to bypass authorization gates.

Exploitation Scenario

An attacker with a standard user account — obtained via credential stuffing against a developer portal, a phished employee, or a malicious insider — authenticates to the OpenClaw instance. Rather than using the web UI (which may surface only admin-visible controls), the attacker crafts direct HTTP requests to the ACP chat command API endpoints documented in the vendor advisory. Since the server performs no `operator.admin` scope validation on mutating operations, the requests succeed. The attacker registers a malicious skill modeled on legitimate ones (mirroring AIID #1368 patterns) that silently exfiltrates conversation history and API keys embedded in agent configuration to an attacker-controlled endpoint, or modifies the agent's system prompt to redirect sensitive user queries — all without generating admin-tier audit events or triggering alerting on privilege escalation.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.