Timing Vulnerability in OpenClaw Affects Authorization Processes

CVE-2026-35637

What is CVE-2026-35637?

Prior to the release of version 2026.3.22, OpenClaw exhibits a timing vulnerability where cite expansion is performed before completing authorization checks for channels and direct messages (DMs). This allows unauthorized access to manipulate and handle content during the interim period when the authorization has not yet been validated. Attackers can exploit this flaw, leading to potential unauthorized disclosures or modifications of sensitive information.

References