Settings Reconciliation Bypass in OpenClaw Affects Users

CVE-2026-35649

What is CVE-2026-35649?

OpenClaw prior to version 2026.3.22 is susceptible to a settings reconciliation vulnerability that allows attackers to bypass intended access control measures. By exploiting the handling of empty allowlists, malicious actors can inadvertently restore previously revoked permissions. This behavior occurs because the system treats explicit empty allowlists as unset during the reconciliation process, leading to misconfigured access controls and potential unauthorized access.

References