CVE-2026-35617: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35617 is an authorization bypass vulnerability in OpenClaw's Google Chat group policy enforcement that relies on mutable space display names. Affected versions are all releases of the openclaw npm package up to and including 2026.3.24; the issue is fixed in version 2026.3.25. The vulnerability was published on April 9, 2026, with the security advisory authored by steipete and credited to reporter zpbrent. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is that OpenClaw's resolveGroupConfig function previously matched Google Chat group policies using mutable space displayName values rather than stable, immutable space IDs (e.g., spaces/<id>). This falls under CWE-807 (Reliance on Untrusted Inputs in a Security Decision) and CWE-639 (Authorization Bypass Through User-Controlled Key), as well as CWE-863 (Incorrect Authorization). An attacker with low privileges who can rename a Google Chat space — or create a space whose display name collides with an existing policy-bound name — can cause the system to apply the wrong group policy, granting access to protected resources. The fix (commit 11ea1f67863d88b6cbcb229dd368a45e07094bff) changes resolveGroupConfig to look up policies exclusively by stable spaces/ IDs and to fail closed (deny) when a deprecated mutable name match is detected, rather than falling back to a wildcard policy (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged attacker with network access to bypass Google Chat group authorization controls and gain unauthorized access to resources protected by group policies. The impact is limited to low confidentiality and low integrity compromise of the vulnerable system, with no availability impact and no effect on subsequent systems. In practice, this could allow an attacker to interact with OpenClaw-protected Google Chat spaces or commands they should not have access to, potentially exposing sensitive information or enabling unauthorized actions within those spaces (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.048%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (the ability to rename or create a Google Chat space) and high attack complexity, limiting the practical attacker pool (Feedly).

1. Reconnaissance: Identify an OpenClaw deployment (npm package openclaw ≤ 2026.3.24) integrated with Google Chat and using display-name-based group policies (i.e., policy keys that are not spaces/<id> format).
2. Identify target policy: Determine the display name of a Google Chat space that is bound to a privileged group policy in the OpenClaw configuration (e.g., "Finance Ops").
3. Name collision or rename: As a low-privileged Google Chat user with space management rights, either rename an attacker-controlled space to match the target display name (e.g., Finance Ops), or create a new space with the colliding name.
4. Send a message: Send a message from the attacker-controlled space to the OpenClaw bot. The vulnerable resolveGroupConfig function matches the policy by display name, applying the privileged group policy to the attacker's space.
5. Gain unauthorized access: The attacker's messages are now processed under the matched group policy, granting access to protected commands or resources associated with that policy (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw verbose logs containing "Deprecated Google Chat group key detected: group routing now requires stable space ids (spaces/)" — this message is emitted by the patched version when a mutable key is still configured, and its presence indicates a misconfigured or unpatched deployment.
• Logs: Log entries containing "drop group message (deprecated mutable group key matched, space=spaces/<id>)" indicate that a message was received from a space whose display name matched a deprecated policy key but whose stable ID did not match — a potential exploitation attempt.
• Behavioral: Unexpected or unauthorized interactions with OpenClaw from Google Chat spaces not previously associated with privileged group policies, particularly spaces with display names matching existing policy entries.
• Configuration: OpenClaw group policy configuration (channels.googlechat.groups) containing keys that are plain display names (e.g., "Finance Ops") rather than stable spaces/<id> format identifiers, indicating vulnerability to this attack (GitHub Commit, GitHub Advisory).

Upgrade the openclaw npm package to version 2026.3.25 or later, which enforces stable spaces/<id> identifiers for group policy lookups and fails closed on deprecated mutable name matches. As a configuration-level workaround prior to upgrading, administrators should update all channels.googlechat.groups policy keys from human-readable display names to stable Google Chat space IDs (e.g., replace "Finance Ops" with "spaces/XXXXXXXXX"). Additionally, audit existing group policy bindings to confirm they have not been exploited, and monitor verbose logs for deprecation warnings (GitHub Advisory, GitHub Commit).