CVE-2026-35631
Authorization Bypass in OpenClaw ACP Commands Allows Unauthorized Modifications
Publication date: 2026-04-09
Last updated on: 2026-04-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.3.22, where the software fails to enforce the operator.admin scope on certain internal ACP chat commands that modify system settings. As a result, attackers who do not have administrative privileges can execute these mutating control-plane actions by directly invoking the affected ACP commands, effectively bypassing the normal authorization checks.
How can this vulnerability impact me? :
The impact of this vulnerability is that unauthorized users with limited privileges can perform administrative actions that should be restricted. This can lead to unauthorized modifications within the system, potentially compromising the integrity of the control plane and allowing attackers to manipulate system behavior without proper authorization.