CVE-2026-35649

MEDIUM6.5

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

Published Apr 10, 2026

Modified 2 weeks ago

Details

OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.

References

FIX

https://github.com/openclaw/openclaw/commit/3cbf932413e41d1836cb91aed1541a28a3122f93

FIX

https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87

ADVISORY

https://github.com/openclaw/openclaw/security/advisories/GHSA-pw7h-9g6p-c378

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-35649

ADVISORY

https://www.vulncheck.com/advisories/openclaw-settings-reconciliation-bypass-via-empty-allowlist

CVSS Analysis