CVE-2026-35652

CVE-2026-35652 is an authorization bypass vulnerability affecting OpenClaw versions prior to 2026.3.22. The flaw exists in the interactive callback dispatch mechanism, allowing attackers to bypass sender authorization checks and execute action handlers that should be restricted to allowlisted senders. This enables unauthorized execution of actions through race condition-like behavior where callbacks are dispatched before normal security validation completes. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring no privileges or user interaction. The attack has low complexity and can result in integrity and availability impacts, though confidentiality is not affected. The FAUCET Risk Score of 53.0/100 indicates moderate operational concern. Current exploitation status appears limited, with no known exploits currently documented in public databases and the vulnerability not appearing on active threat lists. The EPSS score of 0.000580000 suggests relatively low real-world exploitation probability compared to other CVEs. However, organizations running vulnerable versions of OpenClaw should prioritize patching to version 2026.3.22 or later to remediate this authorization control defect before potential attack campaigns emerge.