What’s Vulnerable › Vulnerabilities

CVE-2026-35637: OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-06-17
• Weakness: CWE-696

Description

OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.

Affected products

• OpenClaw: before 2026.3.22 — fixed in 2026.3.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.22. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/3cbf932413e41d1836cb91aed1541a28a3122f93
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
• https://github.com/openclaw/openclaw/commit/ebee4e2210e1f282a982c7ef2ad79d77a572fc87
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vfg3-pqpq-93m4
• https://www.vulncheck.com/advisories/openclaw-premature-cite-expansion-before-authorization-in-channel-and-dm

Get alerted when CVE-2026-35637 or the next vulnerability affects your stack