Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization policy. Attackers can exploit chat.send to build an internal command-authorized context and persist channel allowFrom and groupAllowFrom policy changes reserved for operator.admin scope.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35621 OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, … https://www.cve.org/CVERecord?id=CVE-2026-35621
Post summary
The statement reports a privilege escalation flaw in OpenClaw before version 2026.3.24, noting that the /allowlist command does not re-validate gateway client scopes for internal callers.
🚨*CVE* CVE-2026-35621 OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, … https://www.cve.org/CVERecord?id=CVE-2026-35621 ----- Traducción: CVE-2026-35621 Ope… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑35621, a privilege escalation vulnerability in OpenClaw, with a brief technical description and links to the official CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |