p PatchFirst

CVE-2026-35617

CVE-2026-35617 · OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.

CVSS 2.3 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.3.25: Affected (semver)
    • 2026.3.25: Not affected (semver)

    Update to 2026.3.25

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.3.28

    Update to 2026.3.28

Original sources

Check your server →