PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35674 OpenClaw CVE debrief

A scope bypass vulnerability in OpenClaw before 2026.5.18 allows attackers with operator.write scope to execute privileged commands through the Gateway chat.send route. The vulnerability stems from improper authorization checks when scoped clients deliver commands through inherited external routes, bypassing required operator.approvals and operator.admin scope validations. This enables unauthorized mutations to plugins, configuration, MCP (Model Context Protocol), allowlists, and ACP (Access Control Policy) settings. The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high impacts to confidentiality, integrity, and availability. The weakness is classified as CWE-863 (Incorrect Authorization). The vulnerability was disclosed via GitHub Security Advisory and Vulncheck advisory, with NVD status currently Undergoing Analysis.

Vendor
OpenClaw
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations running OpenClaw Gateway versions prior to 2026.5.18 with multi-tenant or scoped access configurations, particularly those using operator.write scope for automated clients or third-party integrations. Security teams should prioritize patching due to the high impact on integrity and availability of gateway-managed resources.

Technical summary

OpenClaw Gateway's chat.send route fails to properly validate scope requirements when processing commands from inherited external routes. Clients authenticated with operator.write scope can submit commands that should require operator.approvals or operator.admin scope, due to missing authorization boundary checks. The route inheritance mechanism propagates insufficient scope validation, allowing write operations on sensitive subsystems including plugin management, system configuration, Model Context Protocol handlers, allowlist modifications, and Access Control Policy changes. The vulnerability is remotely exploitable with low complexity once operator.write credentials are obtained.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade OpenClaw to version 2026.5.18 or later
  • Review and audit all operator.write scoped client activities for unauthorized privileged command execution
  • Implement additional authorization checks on inherited external routes in Gateway configurations
  • Monitor for unauthorized plugin, config, MCP, allowlist, and ACP mutations in audit logs
  • Validate scope inheritance patterns in custom route implementations
  • Apply principle of least privilege by restricting operator.write scope assignments
  • Review GitHub Security Advisory GHSA-hw9r-h9mr-4jff for vendor-provided mitigation guidance

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-hw9r-h9mr-4jff and Vulncheck advisory. NVD entry published 2026-05-29 with status Undergoing Analysis. CVSS 4.0 score 8.7 (HIGH). Affected versions: OpenClaw before 2026.5.18.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35674 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35674

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35674 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35674

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.