CVE-2026-35649: OpenClaw access control bypass

CISO Take

OpenClaw before 2026.3.22 contains a settings reconciliation flaw where an explicitly empty allowlist is misread as unset configuration, causing the engine to silently restore permissions that administrators had intentionally revoked via deny-all policies. This is particularly dangerous given AIID #1368's documented active abuse of OpenClaw's third-party skills ecosystem—where roughly 17% of third-party skills were assessed as malicious—because the primary defensive response to a malicious skill (revoking its allowlist entry) is effectively nullified on the next reconciliation cycle without any audit trail or operator alert. The vulnerability requires no authentication and has low attack complexity over the network (CVSS 6.5), meaning any exposed OpenClaw instance can have its revocations silently undone. Upgrade to 2026.3.22 immediately, reapply all allowlist revocations issued under the vulnerable version, and audit reconciliation logs for unexpected permission restorations.

Sources: NVD GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 6.5 Medium, but real-world risk materially exceeds the base score in AI agent deployments where allowlists are the primary authorization boundary for third-party skills and tools. Network-accessible with no authentication required and low attack complexity—requiring no specialized AI or ML knowledge to trigger. EPSS data unavailable; not in CISA KEV; no public exploit or Nuclei template exists at time of analysis. Risk is compounded by AIID #1368's confirmed active malicious skill ecosystem in OpenClaw: any organization that revoked a malicious skill while running a vulnerable version should treat that revocation as potentially ineffective.

How does the attack unfold?

Initial Access

Attacker identifies a network-accessible OpenClaw deployment and confirms a high-value skill permission has been revoked via allowlist following a prior security incident.

AML.T0049

Defense Evasion

Attacker submits a settings reconciliation request with an empty allowlist for the target skill; OpenClaw misinterprets the explicit empty list as unset and queues the revocation for silent reversal.

AML.T0107

Permission Restoration

On the next reconciliation cycle, the previously denied skill or tool access is reinstated without generating an audit event or administrator notification.

AML.T0081

Impact

Attacker invokes the reinstated agent skill to exfiltrate credentials, access internal APIs, or deliver malicious payloads—reproducing the AMOS stealer delivery vector documented in AIID #1368 post-remediation.

AML.T0053

Initial Access

Attacker identifies a network-accessible OpenClaw deployment and confirms a high-value skill permission has been revoked via allowlist following a prior security incident.

AML.T0049

Defense Evasion

Attacker submits a settings reconciliation request with an empty allowlist for the target skill; OpenClaw misinterprets the explicit empty list as unset and queues the revocation for silent reversal.

AML.T0107

Permission Restoration

On the next reconciliation cycle, the previously denied skill or tool access is reinstated without generating an audit event or administrator notification.

AML.T0081

Impact

Attacker invokes the reinstated agent skill to exfiltrate credentials, access internal APIs, or deliver malicious payloads—reproducing the AMOS stealer delivery vector documented in AIID #1368 post-remediation.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Upgrade to OpenClaw 2026.3.22 or later (patches in commits 630f1479c4 and 3cbf932413).
After upgrading, reapply all allowlist revocations made under a vulnerable version—assume any revocation issued since the vulnerable release may have been silently reversed.
Audit settings reconciliation event logs for unexpected permission restorations, particularly for skills previously flagged as suspicious or explicitly revoked.
Enforce out-of-band access controls (network policies, API gateway rules) that do not rely solely on OpenClaw's reconciliation logic, providing a secondary enforcement layer independent of the vulnerable reconciliation path.
Subscribe to OpenClaw security advisories (GHSA channel) to receive future patch notifications promptly.

How is it classified?

Auth Bypass Supply Chain Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

8.4 - AI system risk management

NIST AI RMF

GOVERN 1.2 - Accountability structures for AI risk

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35649?

OpenClaw before 2026.3.22 contains a settings reconciliation flaw where an explicitly empty allowlist is misread as unset configuration, causing the engine to silently restore permissions that administrators had intentionally revoked via deny-all policies. This is particularly dangerous given AIID #1368's documented active abuse of OpenClaw's third-party skills ecosystem—where roughly 17% of third-party skills were assessed as malicious—because the primary defensive response to a malicious skill (revoking its allowlist entry) is effectively nullified on the next reconciliation cycle without any audit trail or operator alert. The vulnerability requires no authentication and has low attack complexity over the network (CVSS 6.5), meaning any exposed OpenClaw instance can have its revocations silently undone. Upgrade to 2026.3.22 immediately, reapply all allowlist revocations issued under the vulnerable version, and audit reconciliation logs for unexpected permission restorations.

Is CVE-2026-35649 actively exploited?

No confirmed active exploitation of CVE-2026-35649 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35649?

1. Upgrade to OpenClaw 2026.3.22 or later (patches in commits 630f1479c4 and 3cbf932413). 2. After upgrading, reapply all allowlist revocations made under a vulnerable version—assume any revocation issued since the vulnerable release may have been silently reversed. 3. Audit settings reconciliation event logs for unexpected permission restorations, particularly for skills previously flagged as suspicious or explicitly revoked. 4. Enforce out-of-band access controls (network policies, API gateway rules) that do not rely solely on OpenClaw's reconciliation logic, providing a secondary enforcement layer independent of the vulnerable reconciliation path. 5. Subscribe to OpenClaw security advisories (GHSA channel) to receive future patch notifications promptly.

What systems are affected by CVE-2026-35649?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration platforms, multi-agent pipelines, skill and tool marketplaces.

What is the CVSS score for CVE-2026-35649?

CVE-2026-35649 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration platformsmulti-agent pipelinesskill and tool marketplaces

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.

Exploitation Scenario

An attacker targeting an enterprise running OpenClaw for internal AI agent orchestration identifies that a high-value skill—such as a credential retrieval connector or internal API accessor—was recently revoked by the security team following suspicious activity consistent with AIID #1368. The attacker submits a settings reconciliation request to OpenClaw's network-accessible API with an empty allowlist for the affected skill configuration, which requires no authentication. OpenClaw's reconciliation engine misinterprets the empty list as an unset field rather than an explicit deny, and silently restores the previously revoked permission on the next reconciliation pass. The attacker then invokes the reinstated skill through OpenClaw's agent interface to exfiltrate credentials, deliver a stealer payload, or pivot to internal systems—reproducing the AMOS stealer delivery vector documented in AIID #1368 even after the organization believed it had contained the threat.

Weaknesses (CWE)

CWE-183 Permissive List of Allowed Inputs

CWE-183 — Permissive List of Allowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Source: MITRE CWE corpus.