CVE-2026-35670: OpenClaw webhook rebinding exposes

CISO Take

OpenClaw's webhook reply system routes messages by mutable username rather than stable numeric user IDs, enabling any authenticated attacker to intercept another user's incoming agent replies simply by renaming their account to match a target's vacated or previous username. The Confidentiality impact is rated High (C:H), meaning a successful redirect fully exposes whatever sensitive payload the agent delivered—credentials, internal data, or PII exchanged through the platform. Attack complexity is rated High (AC:H) and no public exploit or KEV listing exists, limiting opportunistic risk; however, insider threats and targeted attacks are viable given the Low Privileges Required (PR:L) threshold. Organizations using OpenClaw should upgrade to 2026.3.22 immediately (patches in commits 630f147 and 7ade355); if patching is blocked, enforce username immutability at the directory level and audit webhook event logs for recipient mismatches.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium risk overall (CVSS 5.9, AC:H), with elevated concern for regulated or high-trust deployments. Exploitation requires low privileges but precise timing—the attacker must rename their account to match the target's username before the pending webhook reply is delivered, demanding prior reconnaissance. No public exploit code, no Nuclei scanner template, and no CISA KEV listing reduce near-term opportunistic risk significantly. That said, the C:H CVSS rating means any successful exploitation fully exposes victim reply content, and the 395 other CVEs on this package signal persistent security hygiene issues. Insider threat scenarios—where the attacker already has platform access and target-user familiarity—are the most realistic exploitation path.

How does the attack unfold?

Reconnaissance

Attacker identifies a high-value OpenClaw user and determines when a sensitive webhook reply is expected, monitoring username history to find a reclaimable handle.

AML.T0087

Identity Hijacking

Attacker renames their account to match the target's vacated or previous username, exploiting the platform's mutable-username recipient resolution before the pending reply is dispatched.

AML.T0073

Webhook Exploitation

OpenClaw's reply dispatcher resolves the recipient by current username and delivers the sensitive AI agent output—credentials, internal data, or PII—to the attacker's session.

AML.T0049

Data Exfiltration

Attacker captures the misdirected agent output and renames back to their original handle; the legitimate user receives no reply, delaying detection and breach notification.

AML.T0025

Reconnaissance

Attacker identifies a high-value OpenClaw user and determines when a sensitive webhook reply is expected, monitoring username history to find a reclaimable handle.

AML.T0087

Identity Hijacking

Attacker renames their account to match the target's vacated or previous username, exploiting the platform's mutable-username recipient resolution before the pending reply is dispatched.

AML.T0073

Webhook Exploitation

OpenClaw's reply dispatcher resolves the recipient by current username and delivers the sensitive AI agent output—credentials, internal data, or PII—to the attacker's session.

AML.T0049

Data Exfiltration

Attacker captures the misdirected agent output and renames back to their original handle; the legitimate user receives no reply, delaying detection and breach notification.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to 2026.3.22 or later; the fix in commits 630f147 and 7ade355 replaces mutable-username binding with stable numeric user IDs.
If immediate patching is blocked, enforce username immutability in your identity provider—prevent self-service renames at the platform or SSO layer.
Audit webhook event delivery logs for records where the recipient username at delivery time differs from the username captured when the webhook event was recorded.
For GDPR-regulated environments, treat any webhook reply delivery since 2026-04-10 as potentially misdirected—assess whether a personal data breach notification obligation exists if sensitive data was involved.
Add detection: alert on username changes within short windows preceding pending webhook deliveries.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent API AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0073 - Impersonation AML.T0087 - Gather Victim Identity Information

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.1.2 - Segregation of duties

NIST AI RMF

GOVERN 1.7 - Processes and procedures for AI risk management

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35670?

OpenClaw's webhook reply system routes messages by mutable username rather than stable numeric user IDs, enabling any authenticated attacker to intercept another user's incoming agent replies simply by renaming their account to match a target's vacated or previous username. The Confidentiality impact is rated High (C:H), meaning a successful redirect fully exposes whatever sensitive payload the agent delivered—credentials, internal data, or PII exchanged through the platform. Attack complexity is rated High (AC:H) and no public exploit or KEV listing exists, limiting opportunistic risk; however, insider threats and targeted attacks are viable given the Low Privileges Required (PR:L) threshold. Organizations using OpenClaw should upgrade to 2026.3.22 immediately (patches in commits 630f147 and 7ade355); if patching is blocked, enforce username immutability at the directory level and audit webhook event logs for recipient mismatches.

Is CVE-2026-35670 actively exploited?

No confirmed active exploitation of CVE-2026-35670 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35670?

1. Patch: upgrade OpenClaw to 2026.3.22 or later; the fix in commits 630f147 and 7ade355 replaces mutable-username binding with stable numeric user IDs. 2. If immediate patching is blocked, enforce username immutability in your identity provider—prevent self-service renames at the platform or SSO layer. 3. Audit webhook event delivery logs for records where the recipient username at delivery time differs from the username captured when the webhook event was recorded. 4. For GDPR-regulated environments, treat any webhook reply delivery since 2026-04-10 as potentially misdirected—assess whether a personal data breach notification obligation exists if sensitive data was involved. 5. Add detection: alert on username changes within short windows preceding pending webhook deliveries.

What systems are affected by CVE-2026-35670?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Chatbot and conversational AI platforms, Webhook-based AI integrations.

What is the CVSS score for CVE-2026-35670?

CVE-2026-35670 has a CVSS v3.1 base score of 5.9 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

AI agent frameworksChatbot and conversational AI platformsWebhook-based AI integrations

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0073 Impersonation

AML.T0087 Gather Victim Identity Information

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can manipulate username changes to redirect webhook-triggered replies to different users, bypassing the intended recipient binding recorded in webhook events.

Exploitation Scenario

An insider attacker with a low-privilege OpenClaw account monitors platform activity to identify a high-value target ('alice') who is expecting an agent webhook reply containing a temporary API token or sensitive system output. The attacker waits for alice to change her username (or social-engineers the change), then immediately renames their own account to the newly-vacated 'alice'. OpenClaw's reply dispatcher resolves the recipient by current username and delivers the pending webhook reply—including the sensitive agent output—to the attacker's session. The attacker captures the token or data and renames back to their original handle. The legitimate user never receives the reply, potentially attributing the miss to a transient platform error rather than a security incident, delaying detection indefinitely.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.