CVE-2026-35662 Overview
CVE-2026-35662 is a Missing Authorization vulnerability affecting OpenClaw, a Node.js package. The vulnerability exists because OpenClaw versions prior to 2026.3.22 fail to enforce controlScope restrictions on the send action. This flaw allows leaf subagents to send messages to controlled child sessions beyond their authorized scope, effectively bypassing intended access control restrictions.
Critical Impact
Attackers with low privileges can exploit this vulnerability to communicate with child sessions without proper scope validation, bypassing authorization controls designed to restrict inter-session messaging.
Affected Products
- OpenClaw versions prior to 2026.3.22
- OpenClaw Node.js package (all affected versions)
Discovery Timeline
- 2026-04-10 - CVE-2026-35662 published to NVD
- 2026-04-13 - Last updated in NVD database
Technical Details for CVE-2026-35662
Vulnerability Analysis
This vulnerability is classified as CWE-862 (Missing Authorization). The core issue lies in the inadequate enforcement of controlScope restrictions within OpenClaw's send action handler. When a leaf subagent invokes the send action, the system fails to validate whether the target child session falls within the subagent's authorized scope boundaries.
The vulnerability is exploitable over the network and requires low privileges to execute. While no user interaction is required, the impact is limited to integrity violations—allowing unauthorized message delivery to controlled sessions. There is no direct impact on confidentiality or availability.
Root Cause
The root cause is a missing authorization check in the send action implementation. When processing send requests from leaf subagents, the code path responsible for validating controlScope boundaries is either bypassed or not properly implemented. This allows subagents to reference and communicate with child sessions that should be outside their authorized control scope.
Attack Vector
An attacker with access to a leaf subagent within the OpenClaw system can exploit this vulnerability by crafting send action requests targeting child sessions outside their authorized controlScope. The attack requires:
- Access to a legitimate leaf subagent within the OpenClaw environment
- Knowledge of target child session identifiers
- Ability to invoke the send action through the subagent interface
The vulnerability allows the attacker to bypass session isolation boundaries, potentially enabling unauthorized command execution or data manipulation within child sessions that should be inaccessible to the compromised subagent.
Detection Methods for CVE-2026-35662
Indicators of Compromise
- Unusual send action requests from leaf subagents targeting sessions outside their normal control scope
- Unexpected inter-session communication patterns in OpenClaw logs
- Subagent activities involving child sessions that are not part of their configured controlScope
Detection Strategies
- Monitor OpenClaw application logs for send action requests that cross controlScope boundaries
- Implement audit logging for all inter-session messaging to identify anomalous patterns
- Review subagent activity logs for attempts to access sessions beyond authorized scope
Monitoring Recommendations
- Enable verbose logging for send actions within OpenClaw deployments
- Configure alerting for send action requests that would violate controlScope restrictions
- Regularly audit subagent permissions and their associated control scope configurations
How to Mitigate CVE-2026-35662
Immediate Actions Required
- Upgrade OpenClaw to version 2026.3.22 or later immediately
- Review subagent configurations to ensure controlScope is properly defined
- Audit recent logs for any suspicious send action activity that may indicate exploitation attempts
Patch Information
The OpenClaw maintainers have addressed this vulnerability through security patches. Two commits have been released to fix the missing authorization check:
For complete details, refer to the GitHub Security Advisory GHSA-x2cm-hg9c-mf5w.
Workarounds
- Restrict network access to OpenClaw instances to trusted environments only
- Implement additional application-layer authorization checks before processing send actions
- Consider deploying network segmentation to limit the exposure of OpenClaw deployments
# Upgrade OpenClaw to patched version
npm update openclaw@2026.3.22
# Verify installed version
npm list openclaw
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
