1. Home
  2. CVE Database
  3. CVE-2026-35648
LOW · 3.7

CVE-2026-35648

OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or ...

Vulnerability Description

OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
OpenclawOpenclaw< 2026.3.22

Related Weaknesses (CWE)

CWE-367

References

FAQ

What is CVE-2026-35648?

CVE-2026-35648 is a vulnerability with a CVSS score of 3.7 (LOW). OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or ...

How severe is CVE-2026-35648?

CVE-2026-35648 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-35648?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.