En bref
- CVE-2026-35617 est une vulnérabilité MOYENNE (CVSS 5.4) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.24%, plus élevée que 14.7% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.25, 2026.3.28 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.25
| 2026.3.25
|
| openclaw npm | < 2026.3.28
| 2026.3.28
|
Description
Summary
Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName
Affected Packages / Versions
- Package:
openclaw
- Affected versions:
<= 2026.3.24
- First patched version:
2026.3.25
- Latest published npm version at verification time:
2026.3.24
Details
Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.
Fix Commit(s)
11ea1f67863d88b6cbcb229dd368a45e07094bff
NVD description
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free