CVE-2026-35621 | BDVDB-2026-326339 Detail

Description#

OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization policy. Attackers can exploit chat.send to build an internal command-authorized context and persist channel allowFrom and groupAllowFrom policy changes reserved for operator.admin scope.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-10Record published in the CVE List.
2. Version 22026-06-23Most recent update recorded in the CVE List.