CVE-2026-35631
CVE-2026-35631 · OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without admin privileges can execute mutating control-plane actions by directly invoking affected ACP commands to bypass authorization gates.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3w6x-gv34-mqpf
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
- https://github.com/openclaw/openclaw/commit/229426a257e49694a59fa4e3895861d02a4d767f
- https://www.vulncheck.com/advisories/openclaw-missing-authorization-enforcement-in-internal-acp-chat-commands
- https://nvd.nist.gov/vuln/detail/CVE-2026-35631