Privilege Escalation Vulnerability in OpenClaw by OpenClaw Systems

CVE-2026-35621

What is CVE-2026-35621?

OpenClaw versions prior to 2026.3.24 are susceptible to a privilege escalation vulnerability that allows certain clients to bypass authorization restrictions. Specifically, the /allowlist command does not properly re-validate gateway client scopes for internal callers, enabling clients with operator.write permissions to alter channel authorization policies. Attackers can exploit the chat.send function to create a context that possesses internal command authorization, consequently facilitating unauthorized changes to channel parameters such as allowFrom and groupAllowFrom, which should only be modifiable by users with operator.admin permissions.

References