CVE-2026-35642: OpenClaw auth bypass injects

CISO Take

OpenClaw before version 2026.3.25 contains an authorization bypass (CWE-288) where group reaction events circumvent the requireMention access control gate, allowing any authenticated user to enqueue agent-visible system events that should remain restricted to explicitly authorized actors. Despite a medium CVSS score of 4.3, EPSS places this in the top 90th percentile for exploitation likelihood, and the package carries 396 prior CVEs — a pattern of systemic security debt that warrants treating this library as high-risk regardless of individual severity scores. AI agent deployments that rely on OpenClaw's mention-gated groups as a privilege boundary should assume that boundary is broken: agents will process events from unauthorized sources, potentially expanding action scope, bypassing content policies, or propagating unauthorized instructions downstream. Upgrade to 2026.3.25 immediately (patch commit f8c986); if patching is blocked, restrict reaction permissions in agent-accessible groups to trusted accounts only as a compensating control.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The CVSS score of 4.3 materially understates operational risk for AI agent deployments. EPSS top-90th percentile indicates sustained exploitation interest from the community. The attack requires only low privileges and no user interaction — any authenticated account in the platform can trigger this. The deeper risk is architectural: AI agents treat system events as trusted, authoritative inputs. Injecting unauthorized events into an agent's queue can silently alter decision-making, expand its action scope, or trigger restricted tool invocations without generating security alerts correlated to the original actor. The package's 396-CVE history signals a codebase with sustained vulnerability exposure, raising the prior probability that this bypass will be chained with other findings.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account and identifies a mention-gated OpenClaw group whose system events control an AI agent's authorization scope.

AML.T0012

Access Control Bypass

Attacker posts a group reaction event, which the requireMention check fails to evaluate, enqueuing the event as a trusted agent-visible system event without a valid mention.

AML.T0049

Context Poisoning

The unauthorized reaction event enters the agent's processing pipeline as a trusted system event, injecting attacker-influenced state or instructions into the agent's decision context.

AML.T0080

Unauthorized Agent Action

The agent processes the poisoned event within its elevated authority context, invoking restricted tools, approving workflows, or propagating unauthorized instructions to downstream agents.

AML.T0053

Initial Access

Attacker authenticates with a low-privilege account and identifies a mention-gated OpenClaw group whose system events control an AI agent's authorization scope.

AML.T0012

Access Control Bypass

Attacker posts a group reaction event, which the requireMention check fails to evaluate, enqueuing the event as a trusted agent-visible system event without a valid mention.

AML.T0049

Context Poisoning

The unauthorized reaction event enters the agent's processing pipeline as a trusted system event, injecting attacker-influenced state or instructions into the agent's decision context.

AML.T0080

Unauthorized Agent Action

The agent processes the poisoned event within its elevated authority context, invoking restricted tools, approving workflows, or propagating unauthorized instructions to downstream agents.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.3.25 or later (patch at commit f8c98630785288cc1f1d0893503ef3b653a3cede).
If patching is not immediately possible, restrict reaction permissions in all mention-gated groups to explicitly trusted user roles via group configuration — remove the ability for low-privilege accounts to post reactions in agent-accessible groups.
Audit agent event logs for system events originating from accounts that were not mentioned in the triggering conversation; unexpected sources indicate potential exploitation.
Review downstream integrations that consume OpenClaw system events to assess secondary blast radius.
Treat this as a prompt to audit the full OpenClaw dependency given 396 prior CVEs — evaluate whether this package meets your supply chain risk threshold.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning AML.T0084.002 - Activation Triggers

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system access controls

NIST AI RMF

GOVERN 6.1 - Policies and procedures are in place to address AI risks

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35642?

OpenClaw before version 2026.3.25 contains an authorization bypass (CWE-288) where group reaction events circumvent the requireMention access control gate, allowing any authenticated user to enqueue agent-visible system events that should remain restricted to explicitly authorized actors. Despite a medium CVSS score of 4.3, EPSS places this in the top 90th percentile for exploitation likelihood, and the package carries 396 prior CVEs — a pattern of systemic security debt that warrants treating this library as high-risk regardless of individual severity scores. AI agent deployments that rely on OpenClaw's mention-gated groups as a privilege boundary should assume that boundary is broken: agents will process events from unauthorized sources, potentially expanding action scope, bypassing content policies, or propagating unauthorized instructions downstream. Upgrade to 2026.3.25 immediately (patch commit f8c986); if patching is blocked, restrict reaction permissions in agent-accessible groups to trusted accounts only as a compensating control.

Is CVE-2026-35642 actively exploited?

No confirmed active exploitation of CVE-2026-35642 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35642?

1. Upgrade OpenClaw to version 2026.3.25 or later (patch at commit f8c98630785288cc1f1d0893503ef3b653a3cede). 2. If patching is not immediately possible, restrict reaction permissions in all mention-gated groups to explicitly trusted user roles via group configuration — remove the ability for low-privilege accounts to post reactions in agent-accessible groups. 3. Audit agent event logs for system events originating from accounts that were not mentioned in the triggering conversation; unexpected sources indicate potential exploitation. 4. Review downstream integrations that consume OpenClaw system events to assess secondary blast radius. 5. Treat this as a prompt to audit the full OpenClaw dependency given 396 prior CVEs — evaluate whether this package meets your supply chain risk threshold.

What systems are affected by CVE-2026-35642?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Event-driven agent orchestration, Multi-agent communication platforms, Access-controlled agent automation pipelines.

What is the CVSS score for CVE-2026-35642?

CVE-2026-35642 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksEvent-driven agent orchestrationMulti-agent communication platformsAccess-controlled agent automation pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

AML.T0084.002 Activation Triggers

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger reactions in mention-gated groups to enqueue agent-visible system events that should remain restricted.

Exploitation Scenario

An adversary holds a low-privilege account in an organization's OpenClaw deployment. They identify a mention-gated group whose system events direct an AI agent with elevated tool access — for example, an agent authorized to approve code deployments or query internal data stores. Rather than obtaining an explicit mention (which requires a privileged user to invoke them), the adversary posts a group reaction — an engagement feature not designed as an access control boundary. The requireMention check fails to evaluate reactions as a trigger path. The reaction event is enqueued as a trusted agent-visible system event. The agent processes it within its normal authorization context, potentially triggering a restricted tool call, approving a workflow, or forwarding instructions to a downstream agent — all without the security team correlating the action back to the unprivileged originating account.

Weaknesses (CWE)

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.