In breve
- CVE-2026-35649 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda openclaw (openclaw), openclaw.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.28%, superiore al 20.4% delle vulnerabilità.
- Correzione: aggiornare a 2026.3.22 o successiva.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Tlon settings reconciliation treated explicit empty allowlists as unset, which could silently undo an intended deny-all revocation.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
3cbf932413e41d1836cb91aed1541a28a3122f93
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- extensions/tlon/src/monitor/index.ts now honors explicit empty allowlists as authoritative deny-all configuration.
- extensions/tlon/src/monitor/settings-helpers.test.ts ships regression coverage for explicit empty settings allowlists.
Thanks @zpbrent for reporting.
NVD description
OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free