CVE-2026-35649

OpenClaw versions prior to 2026.3.22 contain a settings reconciliation vulnerability that allows attackers to bypass access control denials by exploiting improper handling of empty allowlists. During the reconciliation process, explicitly configured empty allowlists are treated as unset values, causing the system to silently restore previously revoked permissions and undo intended deny-all access controls. This vulnerability affects the access control mechanisms that are fundamental to the product's security posture. The vulnerability has a CVSS v3.1 score of 6.5 (Medium severity) with a network-based attack vector requiring no authentication or user interaction, making it relatively easy to exploit remotely. The impact is limited to partial confidentiality and integrity compromise without availability impact, suggesting attackers could gain unauthorized access to restricted resources or modify certain system configurations. There is no evidence of active exploitation in the wild at this time, and the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. The EPSS score of 0.0003 indicates a very low probability of exploitation within the next 30 days. Community attention appears minimal given the inactive status on vulnerability hotlists, though organizations running affected OpenClaw versions should prioritize updating to version 2026.3.22 or later as part of routine patch management.