Junglewise Threat Intelligence

CVE-2026-35620: OpenClaw missing authorization in /send and /allowlist chat commands

CVE-2026-35620 · Severity: medium · CVSS 5.4 · Published 2026-04-10

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a communication session management tool that allows owners to control message delivery policies for active conversations. A privilege escalation flaw allows lower-privileged users who have general command access to invoke the `/send` command, which is documented as owner-only, and persistently change session delivery settings (turning off replies, re-enabling replies, or resetting to defaults). This gives unauthorized users control over critical messaging behavior that should be restricted to account owners.

Technical details

The vulnerability is a missing privilege check in the `/send` command handler (src/auto-reply/reply/commands-session.ts:212-239). The handler validates only `params.command.isAuthorizedSender` but fails to verify `senderIsOwner`, even though `senderIsOwner` and general command authorization are computed independently (src/auto-reply/command-auth.ts:401-429). When a non-owner sender who has command authorization calls the handler, it proceeds to mutate and persist `sessionEntry.sendPolicy` without owner verification. The vulnerability affects OpenClaw versions from v2026.1.14-1 through v2026.3.23 and is fixed in v2026.3.24. Attack requires network access to a running OpenClaw instance and authentication as a command-authorized (but non-owner) participant; no user interaction is required. An attacker can persistently disable message delivery (`/send off`), re-enable delivery after owner intentionally disabled it, or reset the policy to inherited defaults.

Affected products

  • OpenClaw openclaw >=2026.1.14-1, <2026.3.24

Timeline

  • 2026-03-30: disclosed: GHSA-39mp-545q-w789 published
  • 2026-03-24: patched: Fixed in OpenClaw 2026.3.24

References

Related threats