CVE-2026-35664

EXECUTIVE SUMMARY CVE-2026-35664 is an authentication bypass vulnerability affecting OpenClaw versions prior to 2026.3.25. The flaw resides in the raw card send surface, enabling unauthenticated attackers to bypass DM pairing restrictions and reach callback handling mechanisms without proper authorization, potentially allowing the creation of legacy callback payloads. The vulnerability carries a CVSS 3.1 severity rating of 5.3 (Medium) with a network-based attack vector requiring no special privileges or user interaction. While the integrity impact is rated as low with no confidentiality or availability concerns, the zero authentication requirement lowers the barrier to exploitation. The FAUCET Risk Score of 41.0 out of 100 suggests moderate organizational risk. Exploitation appears limited at this time. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog, and EPSS scoring indicates this CVE has lower exploitation probability compared to the broader CVE landscape. Community attention remains minimal with no indication of active exploitation campaigns or readily available public exploit code, though organizations running affected versions should prioritize patching to version 2026.3.25 or later.