CVE-2026-35648: OpenClaw policy bypass

CISO Take

OpenClaw's AI agent framework fails to revalidate queued node actions against the current command policy at delivery time, creating a TOCTOU window where commands approved under a now-revoked policy can still execute after policy tightening — effectively nullifying runtime governance changes mid-operation. While the CVSS score is low (3.7), the EPSS places this in the top 88th percentile for exploitation likelihood, and in agentic AI deployments the command policy is often the sole runtime enforcement boundary between an agent's elevated tool access and unauthorized operations, making a bypass here more consequential than the numeric score implies. The package carries 396 other CVEs in its history, and AIID #1368 documents real-world credential exfiltration through OpenClaw's skills ecosystem, indicating this platform is already an active target where stale-policy exploits could amplify ongoing abuse. Organizations should upgrade to OpenClaw 2026.3.22 immediately using the referenced patch commits; as a short-term workaround, flush all queued agent actions before applying any policy changes and avoid live dynamic policy updates in production agent environments.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Low CVSS (3.7) with High Attack Complexity limits opportunistic exploitation, but the 88th EPSS percentile indicates meaningful real-world exploitation interest above the raw score. The network attack vector (AV:N) with no privileges required broadens exposure. The critical concern is contextual: in AI agent deployments, command policy is often the sole runtime enforcement layer between an agent's privileged tool access and unauthorized operations. A bypass here can have outsized impact relative to the numeric rating, particularly in pipelines where agents perform file access, external API calls, or data operations. The package's history of 396 CVEs raises additional concerns about overall security posture.

How does the attack unfold?

Action Queue Injection

Attacker queues node actions through OpenClaw while a permissive command policy is active, planting requests that are authorized under the current policy for delayed execution.

AML.T0053

Policy Tightening Trigger

Security operator detects suspicious agent behavior and tightens OpenClaw's command policy to revoke attacker permissions, expecting queued actions to be blocked under the new rules.

TOCTOU Policy Bypass

OpenClaw delivers queued actions without revalidating against the updated policy (CWE-367), allowing commands to execute that are no longer authorized under current restrictions.

AML.T0107

Unauthorized Command Execution

Stale queued commands execute in the agent environment, achieving unauthorized file access, external API calls, or agent operations despite the remediation attempt.

Action Queue Injection

Attacker queues node actions through OpenClaw while a permissive command policy is active, planting requests that are authorized under the current policy for delayed execution.

AML.T0053

Policy Tightening Trigger

Security operator detects suspicious agent behavior and tightens OpenClaw's command policy to revoke attacker permissions, expecting queued actions to be blocked under the new rules.

TOCTOU Policy Bypass

OpenClaw delivers queued actions without revalidating against the updated policy (CWE-367), allowing commands to execute that are no longer authorized under current restrictions.

AML.T0107

Unauthorized Command Execution

Stale queued commands execute in the agent environment, achieving unauthorized file access, external API calls, or agent operations despite the remediation attempt.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Upgrade to OpenClaw 2026.3.22 or later (patch commits 630f147 and ec2c6d8 address the revalidation gap).
If immediate patching is blocked, establish a mandatory procedure to drain and flush all queued node actions before applying any policy change.
Avoid live dynamic policy updates in production; schedule policy changes during maintenance windows with agent queues drained.
Audit agent execution logs post-patch for commands that were queued before a recent policy change and executed after — these may represent exploitation attempts.
Given 396 CVEs in this package's history and documented ecosystem abuse (AIID #1368), conduct a formal assessment of whether OpenClaw is appropriate for production agentic workloads handling sensitive resources.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35648?

OpenClaw's AI agent framework fails to revalidate queued node actions against the current command policy at delivery time, creating a TOCTOU window where commands approved under a now-revoked policy can still execute after policy tightening — effectively nullifying runtime governance changes mid-operation. While the CVSS score is low (3.7), the EPSS places this in the top 88th percentile for exploitation likelihood, and in agentic AI deployments the command policy is often the sole runtime enforcement boundary between an agent's elevated tool access and unauthorized operations, making a bypass here more consequential than the numeric score implies. The package carries 396 other CVEs in its history, and AIID #1368 documents real-world credential exfiltration through OpenClaw's skills ecosystem, indicating this platform is already an active target where stale-policy exploits could amplify ongoing abuse. Organizations should upgrade to OpenClaw 2026.3.22 immediately using the referenced patch commits; as a short-term workaround, flush all queued agent actions before applying any policy changes and avoid live dynamic policy updates in production agent environments.

Is CVE-2026-35648 actively exploited?

No confirmed active exploitation of CVE-2026-35648 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35648?

1. Upgrade to OpenClaw 2026.3.22 or later (patch commits 630f147 and ec2c6d8 address the revalidation gap). 2. If immediate patching is blocked, establish a mandatory procedure to drain and flush all queued node actions before applying any policy change. 3. Avoid live dynamic policy updates in production; schedule policy changes during maintenance windows with agent queues drained. 4. Audit agent execution logs post-patch for commands that were queued before a recent policy change and executed after — these may represent exploitation attempts. 5. Given 396 CVEs in this package's history and documented ecosystem abuse (AIID #1368), conduct a formal assessment of whether OpenClaw is appropriate for production agentic workloads handling sensitive resources.

What systems are affected by CVE-2026-35648?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration pipelines, multi-agent systems, agentic AI automation workflows.

What is the CVSS score for CVE-2026-35648?

CVE-2026-35648 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration pipelinesmulti-agent systemsagentic AI automation workflows

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.

Exploitation Scenario

An attacker with access to an OpenClaw-managed agent — via a compromised user session, a malicious third-party skill (as seen in AIID #1368), or a legitimate but low-privileged account — queues a batch of node actions permitted under the current command policy, such as file reads, external API calls, or credential access operations. A security operator detects suspicious behavior and immediately tightens the command policy to revoke those permissions, believing the queued actions will be blocked. Because OpenClaw evaluates policy at queue time rather than at delivery time (CWE-367 TOCTOU), the queued commands execute anyway, completing the unauthorized operation despite the policy tightening. In automated agentic pipelines with minimal human oversight, the attacker's commands may complete entirely before any alerting fires.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.