OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

TRUNG BÌNH 5.4CVE-2026-35617 · GHSA-52q4-3xjc-6778 · Công bố 09/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35617 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.24%, cao hơn 14.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.25, 2026.3.28 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`< 2026.3.28`	`2026.3.28`

Mô tả

Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.

Fix Commit(s)

11ea1f67863d88b6cbcb229dd368a45e07094bff

Mô tả của NVD

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.