High severity8.0NVD Advisory· Published May 29, 2026· Updated Jul 21, 2026

CVE-2026-35630

Description

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.5.18	2026.5.18

Affected products

OpenClaw/Openclawllm-fuzzy3 versions
<2026.5.18+ 2 more
- (no CPE)range: <2026.5.18
- (no CPE)range: <2026.5.18
- cpe:2.3:a:openclaw:openclaw:*:-:*:*:*:node.js:*:*range: <2026.5.18
OpenClaw/QQBotllm-create
Range: <2026.5.18

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mgq6-vr84-7m2jghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2jnvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-35630ghsaADVISORY
www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttonsnvdThird Party AdvisoryWEB

News mentions

OpenClaw: Six Authorization and Scope Bypass CVEs Disclosed in Single Advisory
Vypr Intelligence · May 29, 2026

cvss	0.520
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000