CVE-2026-35647

CVE-2026-35647 is an access control vulnerability affecting OpenClaw versions prior to 2026.3.25, whereby verification notices bypass configured direct message policies and can be sent to unpaired peers. The flaw stems from insufficient access validation mechanisms that fail to properly enforce DM restrictions before message transmission, allowing attackers to circumvent intended communication boundaries. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no special privileges or user interaction. While the attack complexity is low, the impact is limited to integrity violations without affecting confidentiality or system availability. The EPSS score of 0.00037 indicates minimal real-world exploitation probability to date. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability does not appear on the Known Exploited Vulnerabilities catalog and shows no community activity on relevant security tracking lists, suggesting limited immediate threat. Organizations using affected OpenClaw versions should apply the patch when operationally feasible, though the low exploitation risk does not warrant emergency remediation procedures.