CVE-2026-35620
1 advisory.
npm/openclaw CVE-2026-35620: medium 5.4
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy
Action: Upgrade openclaw to 2026.3.24 or later.
npm i openclaw@2026.3.24Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.3.24 | - |
Fixed versions
| 2026.3.24 |
Sources
- osv: GHSA-39mp-545q-w789
- https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789
- https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83
- https://nvd.nist.gov/vuln/detail/CVE-2026-35620
- https://github.com/openclaw/openclaw/commit/555b2578a8cc6e1b93f717496935ead97bfbed8b
- https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2
- https://github.com/openclaw/openclaw/commit/ea018a68ccb92dbc735bc1df9880d5c95c63ca35
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-missing-authorization-in-send-and-allowlist-chat-commands
CVE-2026-35620 · published · modified · JSON