CVE-2026-35637: OpenClaw auth bypass

CISO Take

OpenClaw, an AI agent framework with channel and DM support, contains an ordering flaw (CWE-696) where cite expansion processes content before authorization checks complete, creating a window in which private channel or DM content can be accessed or manipulated without proper authorization. With no privileges or user interaction required and a network-accessible attack vector, the EPSS score places this in the top 84% of CVEs most likely to see exploitation — real urgency for teams running OpenClaw in multi-user or enterprise environments. The OpenClaw ecosystem is already under active adversarial scrutiny, as documented in AIID Incident #1368 where malicious skills delivered AMOS credential stealers via ClawHub, and this authorization bypass lowers the barrier further for lateral access or data exfiltration within agent deployments. Patch immediately to OpenClaw ≥ 2026.3.22 (three patch commits: 630f1479, 3cbf932, ebee4e2); if patching is not feasible, restrict network access to OpenClaw services and audit channel and DM access logs for anomalous pre-authorization content access patterns.

Sources: NVD EPSS GitHub Advisory ATLAS AIID VulnCheck

What is the risk?

High risk for organizations using OpenClaw in multi-user or enterprise environments. CVSS 7.3 with AV:N/AC:L/PR:N/UI:N makes this trivially exploitable over the network with no prerequisites. The EPSS top-84% placement signals elevated real-world exploitation likelihood despite no public exploit currently. Blast radius is contained by 4 known downstream dependents, but 396 CVEs in the same package signals a historically weak security posture for this component. The lack of CISA KEV listing and no confirmed active exploitation keeps this from critical tier, but the zero-auth network-accessible vector demands prompt remediation.

How does the attack unfold?

Initial Access

Attacker sends a crafted unauthenticated HTTP request to an OpenClaw endpoint that triggers the cite expansion functionality.

AML.T0049

Exploitation

OpenClaw resolves and loads referenced content via cite expansion before completing channel or DM authorization checks due to the CWE-696 incorrect behavior order flaw.

Data Collection

Private channel or DM content is fetched and exposed during the pre-authorization window, allowing the attacker to read sensitive AI agent conversations, injected context, or credential-bearing messages.

AML.T0085

Impact

Attacker exfiltrates sensitive business data, credentials, or agent context from private channels and DMs, potentially enabling further lateral movement or credential compromise within the enterprise environment.

AML.T0025

Initial Access

Attacker sends a crafted unauthenticated HTTP request to an OpenClaw endpoint that triggers the cite expansion functionality.

AML.T0049

Exploitation

OpenClaw resolves and loads referenced content via cite expansion before completing channel or DM authorization checks due to the CWE-696 incorrect behavior order flaw.

Data Collection

Private channel or DM content is fetched and exposed during the pre-authorization window, allowing the attacker to read sensitive AI agent conversations, injected context, or credential-bearing messages.

AML.T0085

Impact

Attacker exfiltrates sensitive business data, credentials, or agent context from private channels and DMs, potentially enabling further lateral movement or credential compromise within the enterprise environment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

5 steps

Patch to OpenClaw ≥ 2026.3.22 immediately — three patch commits address the flaw (630f1479, 3cbf932, ebee4e2 on GitHub).
If immediate patching is not possible, restrict network access to OpenClaw API endpoints to trusted internal IP ranges.
Review channel and DM access logs for anomalous access patterns — specifically content accesses that occur immediately before corresponding authorization log entries.
Audit all downstream services or integrations that rely on OpenClaw's authorization model.
Monitor OpenClaw's GitHub advisory (GHSA-vfg3-pqpq-93m4) and VulnCheck advisory for exploitation intelligence updates.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operational and monitoring controls

NIST AI RMF

GOVERN 1.2 - Accountability structures

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35637?

OpenClaw, an AI agent framework with channel and DM support, contains an ordering flaw (CWE-696) where cite expansion processes content before authorization checks complete, creating a window in which private channel or DM content can be accessed or manipulated without proper authorization. With no privileges or user interaction required and a network-accessible attack vector, the EPSS score places this in the top 84% of CVEs most likely to see exploitation — real urgency for teams running OpenClaw in multi-user or enterprise environments. The OpenClaw ecosystem is already under active adversarial scrutiny, as documented in AIID Incident #1368 where malicious skills delivered AMOS credential stealers via ClawHub, and this authorization bypass lowers the barrier further for lateral access or data exfiltration within agent deployments. Patch immediately to OpenClaw ≥ 2026.3.22 (three patch commits: 630f1479, 3cbf932, ebee4e2); if patching is not feasible, restrict network access to OpenClaw services and audit channel and DM access logs for anomalous pre-authorization content access patterns.

Is CVE-2026-35637 actively exploited?

No confirmed active exploitation of CVE-2026-35637 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35637?

1. Patch to OpenClaw ≥ 2026.3.22 immediately — three patch commits address the flaw (630f1479, 3cbf932, ebee4e2 on GitHub). 2. If immediate patching is not possible, restrict network access to OpenClaw API endpoints to trusted internal IP ranges. 3. Review channel and DM access logs for anomalous access patterns — specifically content accesses that occur immediately before corresponding authorization log entries. 4. Audit all downstream services or integrations that rely on OpenClaw's authorization model. 5. Monitor OpenClaw's GitHub advisory (GHSA-vfg3-pqpq-93m4) and VulnCheck advisory for exploitation intelligence updates.

What systems are affected by CVE-2026-35637?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-user AI agent deployments, Conversational AI platforms, Enterprise AI collaboration tools.

What is the CVSS score for CVE-2026-35637?

CVE-2026-35637 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-user AI agent deploymentsConversational AI platformsEnterprise AI collaboration tools

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.

Exploitation Scenario

An unauthenticated attacker sends a crafted request to an OpenClaw endpoint that triggers cite expansion — content resolution tied to references in messages or documents. Because OpenClaw processes cite expansion before completing channel or DM authorization checks, the attacker's request causes the system to fetch and briefly expose target content during the timing window. The attacker reads private channel messages, DM content, or agent-handled data before the authorization check would have blocked them. In a targeted scenario, an adversary could use this against an enterprise OpenClaw deployment to intercept AI agent conversations containing API keys, internal system information, or sensitive business data shared via private DMs.

Weaknesses (CWE)

CWE-696 Incorrect Behavior Order

CWE-696 — Incorrect Behavior Order: The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Source: MITRE CWE corpus.