CVE-2026-35652: OpenClaw auth bypass enables

CISO Take

CVE-2026-35652 is an authorization bypass in OpenClaw's interactive callback dispatch mechanism that allows any network-accessible, unprivileged attacker to execute action handlers restricted to allowlisted senders by racing callbacks before security validation completes. For organizations running OpenClaw-based AI agents, this means any reachable attacker can trigger agent actions outside the intended trust boundary — a particularly acute risk given that AI agents are routinely granted elevated tool access to data stores, APIs, and internal systems whose blast radius far exceeds a traditional auth bypass. With only 4 downstream dependents and no public exploit or KEV listing, near-term exposure is limited, but the CVSS AC:L/PR:N/UI:N profile means exploitation requires minimal skill against any exposed instance, and the 396 other CVEs in this package signal a historically troubled codebase. Upgrade to OpenClaw 2026.3.22 or later immediately; if patching is delayed, restrict agent endpoints to internal networks and audit action handler invocation logs for dispatch events from non-allowlisted senders.

Sources: NVD GitHub Advisory ATLAS vendor-advisory (github.com/openclaw) VulnCheck

What is the risk?

Medium risk with elevated concern in AI agent deployments. CVSS 6.5 reflects limited confidentiality impact but real integrity and availability consequences (I:L/A:L). The zero-privilege, low-complexity, network-reachable vector is concerning for any publicly exposed OpenClaw instance. The AI agent context materially amplifies risk: action handlers in agentic systems typically carry downstream tool access — file systems, APIs, databases — whose side effects extend well beyond what a classical auth bypass would reach. No active exploitation evidence and no public exploit reduce near-term urgency, but the 396 prior CVEs in this package warrant serious scrutiny of any OpenClaw deployment.

How does the attack unfold?

Initial Access

Attacker identifies a network-accessible OpenClaw agent endpoint via scanning or targeted recon against a known organization's AI infrastructure.

AML.T0049

Authorization Bypass

Attacker dispatches callback requests timed to arrive before sender authorization validation completes, exploiting the incorrect operation order (CWE-696) to circumvent the sender allowlist check.

AML.T0107

Unauthorized Handler Execution

Non-allowlisted sender successfully invokes registered action handlers, gaining the ability to execute any agent action within the OpenClaw deployment's configured capability set.

AML.T0053

Impact

Adversary abuses invoked handlers to manipulate data, disrupt agent availability, or pivot to downstream systems accessible through the agent's tool integrations.

AML.T0108

Initial Access

Attacker identifies a network-accessible OpenClaw agent endpoint via scanning or targeted recon against a known organization's AI infrastructure.

AML.T0049

Authorization Bypass

Attacker dispatches callback requests timed to arrive before sender authorization validation completes, exploiting the incorrect operation order (CWE-696) to circumvent the sender allowlist check.

AML.T0107

Unauthorized Handler Execution

Non-allowlisted sender successfully invokes registered action handlers, gaining the ability to execute any agent action within the OpenClaw deployment's configured capability set.

AML.T0053

Impact

Adversary abuses invoked handlers to manipulate data, disrupt agent availability, or pivot to downstream systems accessible through the agent's tool integrations.

AML.T0108

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A Low

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥2026.3.22 (patched in commits 630f147 and a47722d per the security advisory).
Network isolation: If patching is delayed, restrict OpenClaw agent endpoints to trusted internal networks — the AV:N vector requires reachability.
Allowlist audit: Review and tighten sender allowlists to the minimum set of authorized callers.
Detection: Monitor action handler invocation logs for executions originating from non-allowlisted senders; alert on callback dispatch events that precede completed authorization in OpenClaw debug telemetry.
Inventory: Run 'pip show openclaw' across all environments (dev, staging, prod) to confirm version and exposure surface.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.2 - Information security roles and responsibilities

NIST AI RMF

MANAGE 2.2 - Mechanisms to prevent unauthorized access to AI system components

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35652?

CVE-2026-35652 is an authorization bypass in OpenClaw's interactive callback dispatch mechanism that allows any network-accessible, unprivileged attacker to execute action handlers restricted to allowlisted senders by racing callbacks before security validation completes. For organizations running OpenClaw-based AI agents, this means any reachable attacker can trigger agent actions outside the intended trust boundary — a particularly acute risk given that AI agents are routinely granted elevated tool access to data stores, APIs, and internal systems whose blast radius far exceeds a traditional auth bypass. With only 4 downstream dependents and no public exploit or KEV listing, near-term exposure is limited, but the CVSS AC:L/PR:N/UI:N profile means exploitation requires minimal skill against any exposed instance, and the 396 other CVEs in this package signal a historically troubled codebase. Upgrade to OpenClaw 2026.3.22 or later immediately; if patching is delayed, restrict agent endpoints to internal networks and audit action handler invocation logs for dispatch events from non-allowlisted senders.

Is CVE-2026-35652 actively exploited?

No confirmed active exploitation of CVE-2026-35652 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35652?

1. Patch: Upgrade to OpenClaw ≥2026.3.22 (patched in commits 630f147 and a47722d per the security advisory). 2. Network isolation: If patching is delayed, restrict OpenClaw agent endpoints to trusted internal networks — the AV:N vector requires reachability. 3. Allowlist audit: Review and tighten sender allowlists to the minimum set of authorized callers. 4. Detection: Monitor action handler invocation logs for executions originating from non-allowlisted senders; alert on callback dispatch events that precede completed authorization in OpenClaw debug telemetry. 5. Inventory: Run 'pip show openclaw' across all environments (dev, staging, prod) to confirm version and exposure surface.

What systems are affected by CVE-2026-35652?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, multi-agent orchestration.

What is the CVSS score for CVE-2026-35652?

CVE-2026-35652 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentsmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers can bypass sender authorization checks by dispatching callbacks before normal security validation completes, enabling unauthorized actions.

Exploitation Scenario

An adversary conducting recon against a target organization's AI infrastructure identifies a network-exposed OpenClaw agent endpoint. By crafting callback dispatch requests timed to arrive before the sender authorization check completes — exploiting the incorrect operation ordering flaw (CWE-696) — the attacker's non-allowlisted sender identity slips past the allowlist gate. The attacker then invokes registered action handlers, such as a 'fetch-document' or 'notify-channel' handler used in legitimate workflows. In organizations where OpenClaw agents hold tool access to internal APIs or data stores, this enables data exfiltration, state manipulation, or lateral movement to systems the agent is authorized to reach — all without presenting any valid credentials.

Weaknesses (CWE)

CWE-696 Incorrect Behavior Order

CWE-696 — Incorrect Behavior Order: The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Source: MITRE CWE corpus.