CVE-2026-35617

MEDIUM4.2

OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName

Published Apr 9, 2026

Modified 1 weeks ago

Details

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.

References

FIX

https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff

ADVISORY

https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-35617

ADVISORY

https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-group-policy-rebinding-with-mutable-space-displayname

CVSS Analysis

CVSS v4.0

2.3