CVE-2026-35637: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35637 is an authorization bypass vulnerability in OpenClaw (npm package) caused by premature cite expansion before channel and direct message (DM) authorization checks are completed. Affecting all versions before 2026.3.22, the flaw allows attackers to trigger cite resolution and content handling prior to final authorization decisions in the Tlon extension. It was disclosed on April 9, 2026, with patches released in version 2026.3.22. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-696 (Incorrect Behavior Order): the Tlon extension's message monitor in extensions/tlon/src/monitor/index.ts performed cite expansion — resolving quoted/cited content from channels and DMs via API scry calls — before completing authorization checks against the channel allowFrom list or DM allowlist. This means an unauthenticated or unauthorized sender could craft a message containing a cite (a reference to content in a private channel or DM) and cause the bot to fetch and process that cited content before the deny decision was reached. The fix introduced a resolveAuthorizedMessageText() helper in utils.ts that gates all cite resolution behind an authorizedForCites boolean, ensuring unauthorized paths return only raw text without triggering cross-channel cite fetches (Github Advisory, Fix Commit).

Successful exploitation allows a network-based attacker without any privileges or user interaction to access content from restricted channels or DMs before authorization is enforced, resulting in low-impact confidentiality exposure (unauthorized information disclosure of cited message content), low-impact integrity effects (content manipulation prior to auth decisions), and minor availability impact. The vulnerability is scoped to the vulnerable system with no subsequent system impact, but it could expose sensitive message content from private channels or DMs that the attacker would not otherwise be permitted to read (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported. The low attack complexity and absence of authentication requirements make it theoretically accessible to any network attacker, but the limited impact scope reduces overall risk.

1. Identify target: Locate an OpenClaw instance running a version before 2026.3.22 with the Tlon extension enabled and accessible over the network.
2. Craft a cited message: Construct a message payload containing a cite block referencing a private channel or DM post (e.g., {"block": {"cite": {"chan": {"nest": "chat/~private-ship/ops", "where": "/msg/~victim-ship/<postId>"}}}}) that the attacker would not normally be authorized to access.
3. Send the message: Transmit the crafted message to the OpenClaw bot from an unauthorized sender account (one not on the channel allowFrom or DM allowlist).
4. Trigger premature cite expansion: Because the vulnerable code expands cites before completing authorization checks, the bot performs a scry API call to fetch the referenced private content (e.g., /channels/v4/<nest>/posts/post/<postId>.json) before the deny decision is reached.
5. Observe content exposure: The cited content from the restricted channel or DM is processed by the bot prior to authorization, potentially being included in bot responses, logs, or downstream handling visible to the attacker (Fix Commit, Github Advisory).

• Network: Unexpected outbound scry API calls (e.g., to /channels/v4/<nest>/posts/post/<postId>.json) originating from the OpenClaw bot process in response to messages from senders not on the configured allowlist.
• Logs: OpenClaw runtime logs showing cite resolution activity ([tlon] resolving cite...) immediately followed by authorization denial log entries, indicating cite expansion occurred before the deny path.
• Logs: Log entries showing DM or channel authorization failures for senders not in dmAllowlist or allowFrom, paired with scry fetch activity for cited content in the same message handling cycle.
• Process: The OpenClaw Node.js process making HTTP/API requests to fetch channel post content for messages that were ultimately rejected by authorization checks.

The primary remediation is to upgrade the OpenClaw npm package to version 2026.3.22 or later, which defers all cite expansion until after authorization checks are completed. The fix was shipped across multiple commits (3cbf932, ebee4e2) and is confirmed present in v2026.3.23 and v2026.3.23-2. No configuration-based workaround is documented; upgrading is the only supported mitigation. Organizations should inventory all OpenClaw deployments and apply the patch within their standard maintenance windows (Github Advisory, Fix Commit).

The vulnerability was reported by researcher @zpbrent and acknowledged by the OpenClaw maintainers, with the advisory published by steipete on March 24, 2026. A duplicate GitHub advisory (GHSA-p6j4-wvmc-vx2h) was published and subsequently withdrawn on April 10, 2026, with the canonical advisory remaining at GHSA-vfg3-pqpq-93m4. VulnCheck independently documented the issue in their advisories database. No significant broader media coverage or social media discussion has been identified beyond automated CVE tracking feeds (Github Advisory, Feedly).