npm/openclaw CVE-2026-35663: high 8.8, EPSS 0.28%

OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-9hjh-fr4f-gxc4
• nvd: CVE-2026-35663
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4
• https://github.com/openclaw/openclaw/commit/d3d8e316bd819d3c7e34253aeb7eccb2510f5f48
• https://github.com/openclaw/openclaw

CVE-2026-35663 · published 2026-03-27T22:29:12Z · modified 2026-04-10T17:42:21.007869Z · JSON