Authorization Bypass in OpenClaw's HTTP Endpoint

CVE-2026-35619

What is CVE-2026-35619?

OpenClaw prior to version 2026.3.24 is affected by an authorization bypass vulnerability that compromises the security of the HTTP /v1/models endpoint. Specifically, the vulnerability arises from the failure to enforce operator read scope requirements, allowing attackers with limited permissions to access sensitive gateway model metadata. This risk is exacerbated by the presence of an HTTP compatibility route that bypasses the more stringent WebSocket RPC authorization checks, potentially leading to data leaks and unauthorized access.

References