Authorization Bypass in OpenClaw Callback Dispatch Enables Unauthorized Actions

Executive Summary

CVE-2026-35652 is an authorization bypass vulnerability in OpenClaw versions before 2026.3.22. It occurs in the interactive callback dispatch mechanism, where action handlers are executed before completing normal sender authorization checks.

This flaw allows attackers who are not on the allowlist to dispatch callbacks prematurely, bypassing security validation and enabling unauthorized actions to be executed.

The vulnerability was fixed by enforcing authorization checks before dispatching callbacks and by tightening verification of inbound callbacks and sender allowlists across multiple integrations such as Mattermost and Google Chat.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to execute actions within OpenClaw integrations without proper permission.

• Attackers can bypass sender authorization checks and perform unauthorized operations.
• It requires no privileges or user interaction, making exploitation easier.
• Potential impacts include unauthorized command execution, manipulation of interactive actions, and possible disruption or misuse of integrated communication platforms.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-35652 vulnerability, immediately upgrade OpenClaw to version 2026.3.22 or later, as these versions contain patches that enforce proper authorization checks before dispatching callbacks.

• Apply the patch that enforces callback authorization prior to action dispatch, which fixes the premature execution of action handlers.
• Ensure that the Mattermost integration includes the new authorization step for button click interactions to block unauthorized actions.
• Verify that inbound callback and webhook sender checks are tightened, especially for Mattermost and Google Chat integrations.
• Confirm that Google Chat request verification includes email verification, issuer validation, and add-on principal binding checks.

These steps collectively prevent unauthorized sender actions by enforcing stricter identity and allowlist checks, reducing the risk of unauthorized command execution.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly address how CVE-2026-35652 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0