CVE-2026-35637

CVE-2026-35637 is a timing-based authorization bypass vulnerability affecting OpenClaw versions prior to 2026.3.22. The flaw allows attackers to perform cite expansion operations and access or manipulate content before the application completes channel and direct message authorization checks, creating a window of opportunity for unauthorized actions. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack is relatively straightforward to execute (low complexity) and can result in confidentiality, integrity, and availability impacts across the entire system scope. Currently, this vulnerability is not listed on the Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.000520 indicates minimal real-world exploitation probability to date. Community attention remains low, with a FAUCET risk score of 47.0/100, suggesting organizations should prioritize patching to version 2026.3.22 or later as a preventative measure rather than in response to active threat activity.