OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

보통 5.4CVE-2026-35617 · GHSA-52q4-3xjc-6778 · Published 09/04/2026 · updated 17/06/2026

요약

CVE-2026-35617은(는) openclaw (openclaw), openclaw에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 14.7%보다 높음.
조치: 2026.3.25, 2026.3.28 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`< 2026.3.28`	`2026.3.28`

Description

Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.

Fix Commit(s)

11ea1f67863d88b6cbcb229dd368a45e07094bff

NVD description

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.

References

openclaw/openclaw security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-35617 · ADVISORY
openclaw/openclaw commit 11ea1f6 · WEB
openclaw/openclaw · PACKAGE
vulncheck.com/advisories/openclaw-authorization-bypass-via-group-policy-rebinding-with-mutable-space-displayname · WEB

openclaw의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.3.25

2026.3.25

openclaw

npm

< 2026.3.28

2026.3.28

Description

Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.

Fix Commit(s)

11ea1f67863d88b6cbcb229dd368a45e07094bff

NVD description

openclaw의 다른 취약점

모두 보기 →