CVE-2026-35637
OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
13th
OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.
| CWE | CWE-696 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Apr 9, 2026 |
| Last Updated | Apr 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new high vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
OpenClaw / OpenClaw
0 < 2026.3.22
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-vfg3-pqpq-93m4 github.com: https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 github.com: https://github.com/openclaw/openclaw/commit/3cbf932413e41d1836cb91aed1541a28a3122f93 github.com: https://github.com/openclaw/openclaw/commit/ebee4e2210e1f282a982c7ef2ad79d77a572fc87 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-premature-cite-expansion-before-authorization-in-channel-and-dm
Credits
🔍 Peng Zhou (@zpbrent)