CVE-2026-35621: Openclaw Privilege Escalation Vulnerability

CVE-2026-35621 Overview

OpenClaw before version 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers. This allows operator.write-scoped clients to mutate channel authorization policy, enabling attackers to exploit chat.send to build an internal command-authorized context and persist channelAllowFrom and groupAllowFrom policy changes that should be reserved for operator.admin scope.

Critical Impact

Attackers with limited operator privileges can escalate to administrative control over channel authorization policies, potentially compromising the integrity of access controls across the entire OpenClaw deployment.

Affected Products

• OpenClaw versions prior to 2026.3.24
• OpenClaw for Node.js (all affected versions)

Discovery Timeline

• 2026-04-10 - CVE-2026-35621 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-35621

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), indicating a fundamental flaw in how OpenClaw validates permissions for privileged operations. The core issue lies in the /allowlist command handler, which accepts internal caller contexts without performing proper scope re-validation.

When a client with operator.write scope invokes the chat.send functionality, the system creates an internal command context. This context is then trusted by the /allowlist command handler without verifying that the originating client possesses the required operator.admin scope. As a result, the attacker can persist unauthorized changes to channelAllowFrom and groupAllowFrom policies.

The attack requires network access and a valid authenticated session with at least operator.write scope. Once exploited, the attacker can modify channel authorization policies to grant themselves or other actors elevated access privileges within the OpenClaw environment.

Root Cause

The root cause is insufficient authorization validation in the internal command dispatch mechanism. The /allowlist command trusts the command context established by chat.send without independently verifying that the original client possesses operator.admin scope. This creates a privilege boundary bypass where lower-privileged clients can execute administrative operations by routing through the internal command pathway.

Attack Vector

The attack exploits network-accessible endpoints requiring low-privilege authenticated access. An attacker must first obtain a session with operator.write scope, which represents a legitimate but limited privilege level. The attacker then leverages the chat.send functionality to construct an internal command context that bypasses normal authorization checks when processed by the /allowlist command handler.

The exploitation flow involves:

1. Authenticating with operator.write scope credentials
2. Crafting a chat.send request that triggers internal command processing
3. Using the elevated internal context to invoke /allowlist operations
4. Persisting unauthorized channelAllowFrom or groupAllowFrom policy modifications

No proof-of-concept exploit code is publicly available at this time. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35621

Indicators of Compromise

• Unexpected modifications to channelAllowFrom or groupAllowFrom policies in OpenClaw configuration
• Authorization policy changes originating from clients with operator.write scope rather than operator.admin
• Anomalous /allowlist command invocations following chat.send operations from the same session
• Audit log entries showing policy mutations without corresponding admin-level authentication events

Detection Strategies

• Implement monitoring for /allowlist command executions and correlate with client scope levels to identify unauthorized invocations
• Deploy application-level logging to capture the full context chain from chat.send to internal command execution
• Configure alerts for any authorization policy changes and validate they originate from properly-scoped admin sessions
• Review OpenClaw audit logs for patterns of operator.write clients performing administrative operations

Monitoring Recommendations

• Enable verbose logging for all authorization policy modification operations within OpenClaw
• Implement real-time alerting on changes to channelAllowFrom and groupAllowFrom configurations
• Monitor for unusual patterns of chat.send usage that precede administrative command execution
• Deploy SentinelOne Singularity platform to detect and alert on anomalous application behavior patterns

How to Mitigate CVE-2026-35621

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.24 or later immediately
• Audit all existing channelAllowFrom and groupAllowFrom policies for unauthorized modifications
• Review access logs for any evidence of exploitation prior to patching
• Temporarily restrict operator.write scope assignments to trusted principals until the patch is applied

Patch Information

OpenClaw has released version 2026.3.24 which addresses this privilege escalation vulnerability by implementing proper scope re-validation for internal callers in the /allowlist command handler. The patch ensures that even internally-dispatched commands verify the originating client possesses operator.admin scope before allowing policy modifications.

For complete patch details and upgrade instructions, refer to the GitHub Security Advisory. Additional technical analysis is available in the VulnCheck Advisory.

Workarounds

• Implement network-level access controls to restrict access to OpenClaw administrative endpoints
• Remove operator.write scope from all non-essential clients until the patch can be applied
• Deploy a web application firewall (WAF) rule to inspect and block suspicious /allowlist command patterns
• Enable strict audit logging and manual review of all authorization policy changes as an interim control

# Configuration example - Restrict operator.write scope assignments
# In your OpenClaw configuration, limit scope grants:
openclaw config set --scope-restrictions "operator.write:internal-only"

# Enable enhanced audit logging for policy changes
openclaw config set --audit-level verbose --audit-targets "allowlist,channelPolicy,groupPolicy"

# Verify current version and upgrade
openclaw version
npm update openclaw@2026.3.24