CVE-2026-35638

CVE-2026-35638 is a privilege escalation vulnerability affecting OpenClaw versions prior to 2026.3.22, wherein the Control UI fails to verify device identity for unauthenticated sessions, allowing attackers to declare and retain arbitrary elevated permissions. The vulnerability exploits a device-less allowance path in the trusted-proxy mechanism, enabling unauthorized users to bypass authentication and authorization controls. The vulnerability carries a CVSS score of 8.8 (High), with a network-based attack vector requiring low complexity and low privileges to execute. It poses significant risk across all three impact categories: compromised confidentiality, integrity, and availability of affected systems. The attack requires no user interaction, making it particularly concerning for exposed environments. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. The EPSS probability score of 0.00048 indicates relatively low expected exploitation likelihood compared to the broader CVE population. However, organizations running vulnerable OpenClaw versions should prioritize patching to version 2026.3.22 or later to mitigate the risk of potential future exploitation.