Authorization Bypass in OpenClaw Affects Security of Action Handlers

CVE-2026-35652

What is CVE-2026-35652?

OpenClaw versions prior to 2026.3.22 contain a significant authorization bypass flaw within its interactive callback dispatch mechanism. This vulnerability permits attackers to circumvent sender authorization checks, allowing non-allowlisted senders to execute action handlers before the usual security validations are completed. As a result, unauthorized actions can be performed, potentially compromising the integrity and security of the application. Users are advised to update to the latest version to mitigate this risk.

References