{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2026.3.24"}],"component":"openclaw","cve_ids":["CVE-2026-35625"],"ecosystem":"npm","epss":0.00192,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fqw4-mph7-2vr8","id":"tcs_01M5KFP35XT1MFQQG0TN7R73MD","modified_at":"2026-07-08T08:27:07.326844167Z","published_at":"2026-03-27T22:29:47Z","references":["https://osv.dev/vulnerability/GHSA-fqw4-mph7-2vr8","https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8","https://github.com/openclaw/openclaw/commit/81ebc7e0344fd19c85778e883bad45e2da972229","https://github.com/openclaw/openclaw"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-fqw4-mph7-2vr8","url":"https://osv.dev/vulnerability/GHSA-fqw4-mph7-2vr8"}],"summary":"OpenClaw: Silent privilege escalation via gateway shared-auth reconnect"}