{"action":"Upgrade openclaw to 2026.3.24 or later.","affected":[{"fixed":"2026.3.24","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-35620"],"ecosystem":"npm","epss":0.0046,"exploited":false,"fixed_versions":["2026.3.24"],"ghsa_id":"GHSA-39mp-545q-w789","id":"tcs_01M5KEWTW3RQ5KSJSPT9VW8E7B","modified_at":"2026-07-08T07:27:37.665456702Z","published_at":"2026-03-30T19:06:22Z","references":["https://osv.dev/vulnerability/GHSA-39mp-545q-w789","https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789","https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83","https://nvd.nist.gov/vuln/detail/CVE-2026-35620","https://github.com/openclaw/openclaw/commit/555b2578a8cc6e1b93f717496935ead97bfbed8b","https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2","https://github.com/openclaw/openclaw/commit/ea018a68ccb92dbc735bc1df9880d5c95c63ca35","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-missing-authorization-in-send-and-allowlist-chat-commands"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-39mp-545q-w789","url":"https://osv.dev/vulnerability/GHSA-39mp-545q-w789"}],"summary":"OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy"}