CoreCVE
Back

MEDIUM

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

Published Apr 10, 2026

Description

OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-183

CWE-285

CWE-863

Incorrect Authorization

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Apr 10, 2026
Updated Jun 23, 2026
Reserved Apr 4, 2026
Link CVE-2026-35649
CISA Vulnrichment
Updated Apr 10, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-35649
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-35649
ENISA EUVD
Assigner VulnCheck
Published Apr 10, 2026
Updated Jun 23, 2026
Exploited since n/a
Link EUVD-2026-21444
EUVD-2026-21444 GHSA-PW7H-9G6P-C378