CVE-2026-35619: Openclaw Authorization Bypass Vulnerability

CVE-2026-35619 Overview

OpenClaw before version 2026.3.24 contains an authorization bypass vulnerability (CWE-863) in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model metadata through the HTTP compatibility route, bypassing the stricter WebSocket RPC authorization checks.

Critical Impact

Unauthorized users can enumerate sensitive gateway model metadata by exploiting inconsistent authorization enforcement between HTTP and WebSocket RPC endpoints.

Affected Products

• OpenClaw versions prior to 2026.3.24
• OpenClaw Node.js deployments using HTTP compatibility routes
• Systems relying on WebSocket RPC authorization without HTTP endpoint hardening

Discovery Timeline

• 2026-04-10 - CVE-2026-35619 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-35619

Vulnerability Analysis

This authorization bypass vulnerability stems from inconsistent access control enforcement between OpenClaw's HTTP and WebSocket RPC interfaces. The HTTP /v1/models endpoint, designed as a compatibility route, does not properly validate that the requesting user has the required operator.read scope. Instead, users with only operator.approvals scope—which should not grant model enumeration privileges—can successfully query the endpoint and retrieve gateway model metadata.

The vulnerability represents a classic broken access control pattern where different API transport layers implement authorization checks inconsistently. While the WebSocket RPC interface correctly enforces scope requirements, the HTTP compatibility layer omits these critical checks, creating an exploitable authorization gap.

Root Cause

The root cause is improper authorization logic (CWE-863: Incorrect Authorization) in the HTTP /v1/models endpoint handler. The code path for HTTP requests fails to invoke the same scope validation routines used by the WebSocket RPC handler, allowing requests with insufficient permissions to proceed. This architectural oversight likely occurred when the HTTP compatibility route was added without mirroring the security controls already present in the primary WebSocket interface.

Attack Vector

The attack is network-accessible and requires low privileges—specifically, the attacker needs valid credentials with at least operator.approvals scope. No user interaction is required. An attacker can craft authenticated HTTP GET requests to the /v1/models endpoint to enumerate all gateway model configurations and metadata. This information disclosure could facilitate further attacks by revealing the internal architecture, enabled models, and configuration details of the target OpenClaw deployment.

The exploitation flow involves:

1. Obtaining valid API credentials with operator.approvals scope (the minimum required scope)
2. Sending authenticated HTTP requests to /v1/models instead of using the WebSocket RPC interface
3. Enumerating gateway model metadata that should require operator.read scope

Detection Methods for CVE-2026-35619

Indicators of Compromise

• Unusual HTTP GET requests to /v1/models endpoint from users without operator.read scope
• API access logs showing successful model enumeration from accounts with limited operator.approvals permissions
• Increased reconnaissance activity targeting model metadata endpoints

Detection Strategies

• Implement API access logging that correlates requested endpoints with user scopes to identify unauthorized access patterns
• Deploy SentinelOne Singularity to monitor for anomalous API access patterns and scope violations
• Create alerts for HTTP /v1/models requests from users lacking operator.read scope in your SIEM

Monitoring Recommendations

• Enable detailed API audit logging for all /v1/models endpoint access
• Monitor authentication logs for accounts making unexpected model enumeration requests
• Review access patterns for accounts with operator.approvals scope to detect potential exploitation attempts

How to Mitigate CVE-2026-35619

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.24 or later immediately
• Audit API access logs for evidence of prior exploitation via the /v1/models endpoint
• Review and restrict accounts with operator.approvals scope until patching is complete
• Consider temporarily disabling the HTTP compatibility route if WebSocket RPC is sufficient for operations

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.24. The security fix is available in commit 06de515b6c42816b62ec752e1c221cab67b38501. Organizations should upgrade immediately and review the GitHub Security Advisory for additional details.

Workarounds

• Implement a reverse proxy or API gateway rule to restrict access to /v1/models endpoint based on validated user scopes
• Use network segmentation to limit which systems can access the HTTP compatibility routes
• Add custom middleware to enforce scope validation on HTTP endpoints until the official patch can be applied