Service Discovery Vulnerability in OpenClaw by OpenClaw
CVE-2026-35659

5.1MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
10 April 2026

What is CVE-2026-35659?

OpenClaw prior to version 2026.3.22 contains a service discovery vulnerability that arises from the processing of TXT metadata from Bonjour and DNS-SD. This flaw allows attackers to exploit unresolved service resolution hints to manipulate routing decisions, effectively directing traffic to unintended targets by injecting malicious discovery metadata. As a result, this could potentially compromise system integrity and expose sensitive information.

Affected Version(s)

OpenClaw 0 < 2026.3.22

OpenClaw 2026.3.22

References

https://github.com/openclaw/openclaw/security/advisories/...
third-party-advisory
https://github.com/openclaw/openclaw/commit/630f1479c44f7...
patch
https://github.com/openclaw/openclaw/commit/deecf68b59a9b...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nathan (@nexrin)
KeenSecurityLab
.