CVE-2026-35648
OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions
- State
- Published
- Severity
- 2.3 Low
- Published
- Apr 10, 2026
- Updated
- Jun 23, 2026
- Reserved
- Apr 4, 2026
Description
OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-wj55-88gf-x564)vendor-advisory
- Patch Commit #1patch
- Patch Commit #2patch
- VulnCheck Advisory: OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actionsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.