CVE-2026-35621 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.24 contains a privilege escalation vulnerability caused by /allowlist command failing to re-validate gateway client scopes for internal callers, letting operator.write-scoped clients mutate channel authorization policy, exploit requires attacker to use chat.send to build internal command-authorized context.

Severity & Score

Impact

Attackers can escalate privileges to modify channel authorization policies reserved for higher scopes, compromising access control.

Mitigation

Update to version 2026.3.24 or later.

References

• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-to-allowlist-persistence
• https://github.com/openclaw/openclaw/security/advisories/GHSA-94pw-c6m8-p9p9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner