CVE-2026-35649: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35649 is a settings reconciliation vulnerability in OpenClaw (npm package) that allows unauthenticated network attackers to bypass intended deny-all access control revocations by exploiting improper empty allowlist handling. Affected versions are all OpenClaw releases before 2026.3.22 for Node.js. The vulnerability was published on April 10, 2026, with a fix shipped in version 2026.3.22. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (Feedly, GitHub Advisory).

The root cause is classified as CWE-183 (Permissive List of Allowed Inputs), with additional authorization weaknesses CWE-285 and CWE-863 noted in the GitHub security advisory. During settings reconciliation in the Tlon extension (extensions/tlon/src/monitor/index.ts), the code previously treated an explicit empty allowlist (e.g., dmAllowlist: [] or groupInviteAllowlist: []) as equivalent to an unset value, falling back to the previously stored account allowlist rather than honoring the empty list as a deny-all directive. The fix (commit 3cbf932) changes the reconciliation logic to assign newSettings.dmAllowlist and newSettings.groupInviteAllowlist directly, without the conditional check that previously skipped empty arrays. This means an attacker or misconfigured settings push could silently restore previously revoked permissions without administrator awareness (GitHub Advisory, Fix Commit).

Successful exploitation allows attackers to bypass intended deny-all access control configurations, restoring previously revoked permissions to DM and group invite allowlists without administrator awareness. This results in low confidentiality and low integrity impacts — unauthorized actors may regain access to restricted resources or functionality that administrators explicitly intended to block. Availability is not directly affected, but the silent nature of the permission restoration makes detection and remediation difficult (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is network-exploitable with low attack complexity and requires no privileges or user interaction, though CVSS v4.0 notes attack requirements are present (AT:P). The EPSS score is approximately 0.022%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, VulnCheck Advisory).

1. Identify target: Locate an OpenClaw instance running a version prior to 2026.3.22 with the Tlon extension enabled and active allowlist-based access controls configured.
2. Trigger settings reconciliation: Craft or intercept a settings update payload that sets dmAllowlist or groupInviteAllowlist to an explicit empty array ([]).
3. Exploit empty allowlist handling: Submit the settings payload to the OpenClaw instance. The vulnerable reconciliation logic in extensions/tlon/src/monitor/index.ts interprets the empty array as unset and falls back to the previously stored (non-empty) allowlist, silently restoring revoked permissions.
4. Gain unauthorized access: With permissions restored, the attacker or previously revoked user regains access to DMs or group invites that administrators intended to deny, without triggering any visible alert or log entry indicating a policy change (GitHub Advisory, Fix Commit).

• Logs: Absence of expected log entries reflecting allowlist changes to empty (deny-all) state in OpenClaw runtime logs; log lines such as [tlon] Settings: dmAllowlist updated to <non-empty list> appearing after an administrator intended to set an empty allowlist.
• Configuration: dmAllowlist or groupInviteAllowlist fields in the active runtime configuration retaining non-empty values after an administrator explicitly set them to empty.
• Behavioral: Previously revoked users or accounts regaining the ability to send DMs or receive group invites on the Tlon-integrated OpenClaw instance without any corresponding administrator action (GitHub Advisory).

Upgrade OpenClaw to version 2026.3.22 or later (latest confirmed patched release: v2026.3.23-2). The fix is present in commits 3cbf932413e41d1836cb91aed1541a28a3122f93 and 630f1479c44f78484dfa21bb407cbe6f171dac87. After upgrading, administrators should audit active dmAllowlist and groupInviteAllowlist configurations to verify that any previously set deny-all (empty) allowlists are correctly enforced, and review audit logs for any unauthorized permission restorations that may have occurred prior to patching (GitHub Advisory, VulnCheck Advisory).

The vulnerability was reported by researcher @zpbrent and published as a GitHub Security Advisory (GHSA-pw7h-9g6p-c378) by maintainer @steipete on March 24, 2026. The fix was authored by @vincentkoc. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).