Intel

CVE-2026-35637

openclaw: Incorrect Behavior Order (CVE-2026-35637)

highEPSS 0.4%

Description

OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.

Source: cvelistv5CVE.org (MITRE)OSV (Open Source Vulnerabilities)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

npmopenclaw

Metrics

XIEM Effective CVSS
7.3
Source: nvd-v3
EPSS percentile
34.9 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
63.01
Exploit maturity
no public PoC known
CVSS v3
7.3
CVSS v4
6.9
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-04-09 21:27 UTC
CWE
CWE-696

Weakness classes (CWE)

  • CWE-696Class

    Incorrect Behavior Order

    The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

    cwe.mitre.org →

References & sources