CVE-2026-35657

CVE-2026-35657 is an authorization bypass vulnerability affecting OpenClaw versions prior to 2026.3.25, where the HTTP /sessions/:sessionKey/history route fails to validate the operator.read scope, allowing attackers to access session history without proper permissions. The vulnerability has a CVSS score of 6.5 (Medium) with a network-based attack vector requiring low complexity and low privileges, resulting in high confidentiality impact but no integrity or availability compromise. Exploitation requires authenticated access (PR:L) and poses moderate risk through unauthorized data disclosure. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and shows minimal exploitation activity, with an EPSS score of 0.00026 indicating it ranks higher than only 0.0724 percent of all CVEs in terms of real-world exploitation likelihood. Community attention appears limited, and no public exploit code is readily available, though organizations running affected versions should still prioritize patching to version 2026.3.25 or later to eliminate the authorization control gap.