Medium severity6.5NVD Advisory· Published Apr 9, 2026· Updated Apr 15, 2026
CVE-2026-35631
CVE-2026-35631
Description
OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without admin privileges can execute mutating control-plane actions by directly invoking affected ACP commands to bypass authorization gates.
Affected products
1Patches
2229426a257e4https://github.com/openclaw/openclawvia nvd-ref
630f1479c44fhttps://github.com/openclaw/openclawvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/openclaw/openclaw/commit/229426a257e49694a59fa4e3895861d02a4d767fnvdPatch
- github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87nvdPatch
- github.com/openclaw/openclaw/security/advisories/GHSA-3w6x-gv34-mqpfnvdVendor Advisory
- www.vulncheck.com/advisories/openclaw-missing-authorization-enforcement-in-internal-acp-chat-commandsnvdThird Party Advisory
News mentions
0No linked articles in our index yet.