CVE-2026-35637
OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.25%
- CWE
- CWE-696
- Published
- 2026-04-09
- Last modified
- 2026-06-23
Affected products
- OpenClaw OpenClaw
- OpenClaw OpenClaw
Weakness type
Related vulnerabilities
- CVE-2026-68930 — Russh: Channel-scoped server callbacks can be reached without an open channel
- CVE-2026-44108 — Firewall bypass during shutdown
- CVE-2026-67217 — cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
- CVE-2026-65100 — Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
- CVE-2026-14169 — ads-tec Industrial IT: Account lockout via non-atomic user creation
- CVE-2026-56355 — GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.
- CVE-2026-49318 — Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- CVE-2026-49317 — Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot