CVE-2026-35647: OpenClaw access control bypass

CISO Take

OpenClaw before 2026.3.25 contains a CWE-288 access control flaw that lets any unauthenticated remote attacker deliver verification notices to users outside configured direct message policies, circumventing the peer-pairing trust boundary. Despite the moderate CVSS of 5.3, the EPSS places this vulnerability in the top 80th percentile for exploitation likelihood, and the zero-privilege, network-based, low-complexity attack vector means exploitation can be fully automated with no victim interaction. In AI agent deployments, verification notices are a privileged communication channel — bypassing DM policy enforcement enables convincing impersonation of system-level agent messages, providing a low-effort social engineering entry point into human-in-the-loop workflows. The package's history of 396 CVEs signals deep-seated security debt warranting broader supply chain scrutiny beyond just this individual fix. Upgrade to OpenClaw 2026.3.25 (commit 2383daf5) immediately; if patching is delayed, restrict inbound access to OpenClaw endpoints to trusted IP ranges and audit message logs for verification notices delivered outside established peer-pairing relationships.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The CVSS 5.3 medium rating understates operational risk in AI agent contexts. All three exploitability metrics sit at their easiest values — network-accessible, low complexity, no privileges, no user interaction — meaning mass automated exploitation is trivial once a public proof-of-concept emerges. The EPSS top-80th-percentile placement reflects community-assessed exploitation interest that outpaces the CVSS rating. Impact is integrity-only (I:L) in isolation, but in AI agent deployments where users are conditioned to trust system-initiated verification flows, policy-bypass capabilities function as a social engineering amplifier. The 396 CVEs attributed to the same package constitute a significant supply chain risk signal independent of this specific finding.

How does the attack unfold?

Reconnaissance

Attacker identifies an organization running OpenClaw below version 2026.3.25 and enumerates the DM policy configuration to determine which peer relationships are policy-restricted.

AML.T0006

Exploitation

Attacker sends crafted API requests to the OpenClaw message transmission endpoint targeting users outside configured DM policies, exploiting CWE-288 insufficient access validation before message delivery.

AML.T0049

Social Engineering

Target users receive spoofed verification notices that appear to originate from a legitimate OpenClaw system process and are manipulated into trusting adversary-controlled content or instructions.

AML.T0073

Impact

Adversary achieves unauthorized influence over human operators in the AI agent workflow, enabling follow-on actions such as credential disclosure, approval of malicious agent actions, or navigation to attacker-controlled infrastructure.

AML.T0048.003

Reconnaissance

Attacker identifies an organization running OpenClaw below version 2026.3.25 and enumerates the DM policy configuration to determine which peer relationships are policy-restricted.

AML.T0006

Exploitation

Attacker sends crafted API requests to the OpenClaw message transmission endpoint targeting users outside configured DM policies, exploiting CWE-288 insufficient access validation before message delivery.

AML.T0049

Social Engineering

Target users receive spoofed verification notices that appear to originate from a legitimate OpenClaw system process and are manipulated into trusting adversary-controlled content or instructions.

AML.T0073

Impact

Adversary achieves unauthorized influence over human operators in the AI agent workflow, enabling follow-on actions such as credential disclosure, approval of malicious agent actions, or navigation to attacker-controlled infrastructure.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

4 steps

Patch: Upgrade to OpenClaw 2026.3.25 or apply commit 2383daf5c4a4e08d9553e0e949552ad755ef9ec2 directly.
Workaround (if patching delayed): Restrict inbound network access to OpenClaw API endpoints to known trusted IP ranges; disable external-initiated verification notices if the feature is non-essential.
Detection: Query OpenClaw message logs for verification notices delivered to recipient pairs with no pre-existing DM policy entry; alert on any policy-mismatch deliveries.
Supply chain review: Evaluate whether OpenClaw is a replaceable dependency — 396 lifetime CVEs suggests systemic security maintenance issues. Monitor the VulnCheck advisory (vulncheck.com) for public exploit code emergence given EPSS trajectory.

How is it classified?

Auth Bypass Social Engineering Agent AML.T0049 - Exploit Public-Facing Application AML.T0073 - Impersonation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9(2) - Risk management system — security measures

ISO 42001

A.6.1.6 - Information security for AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI trustworthiness

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35647?

OpenClaw before 2026.3.25 contains a CWE-288 access control flaw that lets any unauthenticated remote attacker deliver verification notices to users outside configured direct message policies, circumventing the peer-pairing trust boundary. Despite the moderate CVSS of 5.3, the EPSS places this vulnerability in the top 80th percentile for exploitation likelihood, and the zero-privilege, network-based, low-complexity attack vector means exploitation can be fully automated with no victim interaction. In AI agent deployments, verification notices are a privileged communication channel — bypassing DM policy enforcement enables convincing impersonation of system-level agent messages, providing a low-effort social engineering entry point into human-in-the-loop workflows. The package's history of 396 CVEs signals deep-seated security debt warranting broader supply chain scrutiny beyond just this individual fix. Upgrade to OpenClaw 2026.3.25 (commit 2383daf5) immediately; if patching is delayed, restrict inbound access to OpenClaw endpoints to trusted IP ranges and audit message logs for verification notices delivered outside established peer-pairing relationships.

Is CVE-2026-35647 actively exploited?

No confirmed active exploitation of CVE-2026-35647 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35647?

1. Patch: Upgrade to OpenClaw 2026.3.25 or apply commit 2383daf5c4a4e08d9553e0e949552ad755ef9ec2 directly. 2. Workaround (if patching delayed): Restrict inbound network access to OpenClaw API endpoints to known trusted IP ranges; disable external-initiated verification notices if the feature is non-essential. 3. Detection: Query OpenClaw message logs for verification notices delivered to recipient pairs with no pre-existing DM policy entry; alert on any policy-mismatch deliveries. 4. Supply chain review: Evaluate whether OpenClaw is a replaceable dependency — 396 lifetime CVEs suggests systemic security maintenance issues. Monitor the VulnCheck advisory (vulncheck.com) for public exploit code emergence given EPSS trajectory.

What systems are affected by CVE-2026-35647?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI communication platforms, human-in-the-loop AI workflows.

What is the CVSS score for CVE-2026-35647?

CVE-2026-35647 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI communication platformshuman-in-the-loop AI workflows

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0073 Impersonation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 9(2)

ISO 42001: A.6.1.6

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers can send verification notices to users outside allowed direct message policies by exploiting insufficient access validation before message transmission.

Exploitation Scenario

An unauthenticated attacker targeting an enterprise using OpenClaw for AI agent-to-human communication identifies that employees routinely act on system verification notices (approving agent actions, confirming identity challenges, or clicking embedded links). By sending crafted requests to the OpenClaw message transmission API without valid peer credentials, the attacker delivers a spoofed verification notice to a target user who is outside the configured DM policy — a user the attacker could not legitimately reach. The recipient, conditioned to treat OpenClaw verification events as authenticated system messages, follows the embedded instructions, which may instruct them to approve a malicious agent action, disclose a session token, or navigate to an adversary-controlled URL — enabling follow-on compromise despite having bypassed no cryptographic control, only an access validation check.

Weaknesses (CWE)

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.