CVE-2026-35621: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35621 is a privilege escalation vulnerability in OpenClaw, a Node.js package, where the /allowlist command fails to re-validate gateway client scopes for internal callers. This allows authenticated clients with operator.write scope to mutate channel authorization policies (allowFrom and groupAllowFrom) that are reserved for operator.admin scope. All versions prior to 2026.3.24 are affected. The vulnerability was published on April 10, 2026, with a patch released in version 2026.3.24. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862: Missing Authorization) at the sink side of the /allowlist command handler. The gateway's documented scope split designates chat.send as a write-scoped action and direct config mutation as an admin-scoped action; however, /allowlist was not updated to enforce this boundary unlike the already-hardened /config and /plugins handlers. An attacker authenticates with operator.write scope, calls chat.send (which is legitimately accessible at that scope), which builds an internal message context with CommandAuthorized: true. The resolveCommandAuthorization() function converts this into isAuthorizedSender=true, and the /allowlist add|remove handler then proceeds to call plugin.allowlist.applyConfigEdit(...) and writeConfigFile(validated.config) without any sink-side check requiring operator.admin scope (GitHub Advisory).

An authenticated attacker with operator.write scope can persistently modify channel authorization policies — specifically allowFrom and groupAllowFrom settings for DM and group channels — that should only be configurable by operator.admin-scoped users. This effectively allows the attacker to widen channel allowlists, undermining the documented control-plane privilege split and potentially granting unauthorized users access to restricted channels. There is no confidentiality or availability impact; the impact is confined to integrity of channel authorization configuration (GitHub Advisory, Feedly).

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit code is publicly available. The GitHub Security Advisory provides vulnerability analysis and remediation guidance but no actionable exploit steps or crafted payloads. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authentication: Obtain or use an existing gateway client credential with operator.write scope on a vulnerable OpenClaw instance (version ≤ 2026.3.23).
2. Invoke chat.send: Call the chat.send API endpoint, which is legitimately accessible to operator.write-scoped clients. This creates an internal message context with CommandAuthorized: true and carries GatewayClientScopes into the reply pipeline.
3. Trigger resolveCommandAuthorization: The internal message context causes resolveCommandAuthorization() to evaluate the caller as isAuthorizedSender=true, since no stricter commands.allowFrom override is configured by default.
4. Issue /allowlist command: Send an /allowlist add dm ... or /allowlist add group ... command through the established internal command-authorized context.
5. Persist unauthorized policy change: The /allowlist handler calls plugin.allowlist.applyConfigEdit(...) and writeConfigFile(validated.config) without checking for operator.admin scope, persisting the attacker-controlled channel authorization policy change (GitHub Advisory).

• Logs: Audit logs showing /allowlist add or /allowlist remove commands executed by clients authenticated with operator.write scope (rather than operator.admin).
• Logs: Unexpected calls to writeConfigFile() or applyConfigEdit() originating from chat.send pipeline contexts.
• File System: Unexpected or unauthorized modifications to channel configuration files managed by OpenClaw, particularly changes to allowFrom or groupAllowFrom fields.
• Application Behavior: Channel allowlists widened to include users or groups not authorized by an administrator, especially for DM or group channels.
• Network: Unusual chat.send API calls followed immediately by /allowlist command activity from the same operator.write-scoped client (GitHub Advisory).

Upgrade OpenClaw to version 2026.3.24 or later, which adds the missing sink-side operator.admin scope check to the /allowlist handler before any call to plugin.allowlist.applyConfigEdit() or writeConfigFile(). As interim measures, restrict operator.write scope assignments to only fully trusted users, audit recent changes to channel authorization policies (allowFrom and groupAllowFrom) for unauthorized modifications, and monitor /allowlist command usage for suspicious activity. No configuration-only workaround is available that fully mitigates the vulnerability without upgrading (GitHub Advisory).