How to Fix CVE-2026-35621: Missing authorization in OpenClaw

By Sai Kiran Pandrala. Last verified: 2026-05-25.

What is CVE-2026-35621?

OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization policy. Attackers can exploit chat.send to build an internal command-authorized context and persist channel allowFrom and groupAllowFrom policy changes reserved for operator.admin scope.

What you'll see

Run the version check that matches your platform:

# Linux
dpkg -s openclaw 2>/dev/null | grep -i version
rpm -q openclaw 2>/dev/null
openclaw --version 2>/dev/null

Compare what you see against the Affected row above (OpenClaw 0 to <2026.3.24). If your build sits inside that range, you are exposed and should patch.

How to fix CVE-2026-35621

The primary fix is to upgrade OpenClaw to the patched build. Use the commands for your platform below; the patched version listed in the vendor advisory is: OpenClaw 2026.3.24.

Ubuntu / Debian

sudo apt-get update
sudo apt-get install --only-upgrade openclaw
openclaw --version 2>/dev/null || dpkg -s openclaw | grep -i version

RHEL / CentOS / Rocky / AlmaLinux

sudo dnf upgrade --security openclaw -y
rpm -q openclaw

SUSE / openSUSE

sudo zypper patch --category security
rpm -q openclaw

Complete PowerShell remediation script (Windows)

# Fix script for CVE-2026-35621 affecting OpenClaw
# Run as administrator. Detect -> backup -> upgrade -> verify -> log.

$ErrorActionPreference = "Stop"
$LogPath  = "C:\Logs\CVE-2026-35621-fix-$(Get-Date -Format yyyyMMdd-HHmmss).log"
New-Item -ItemType Directory -Force (Split-Path $LogPath) | Out-Null
Start-Transcript -Path $LogPath -Append

try {
    Write-Host "[1/4] Detecting installed version of OpenClaw"
    $pkg = winget list --id "OpenClaw" 2>$null
    Write-Host $pkg

    Write-Host "[2/4] Backing up configuration"
    $backup = "C:\Backup\OpenClaw-$(Get-Date -Format yyyyMMdd)"
    New-Item -ItemType Directory -Force $backup | Out-Null
    Get-ChildItem "C:\ProgramData\OpenClaw" -ErrorAction SilentlyContinue |
        Copy-Item -Destination $backup -Recurse -Force -ErrorAction SilentlyContinue

    Write-Host "[3/4] Applying upgrade to OpenClaw 2026.3.24"
    winget upgrade --id "OpenClaw" --silent --accept-source-agreements --accept-package-agreements
    # Fallback: Windows Update for OS-level fixes
    if ($LASTEXITCODE -ne 0) {
        Install-Module -Name PSWindowsUpdate -Force -SkipPublisherCheck -ErrorAction SilentlyContinue
        Import-Module PSWindowsUpdate
        Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot
    }

    Write-Host "[4/4] Verifying patched build"
    winget list --id "OpenClaw"
    Write-Host "Fix applied. Reboot if prompted."
    exit 0
} catch {
    Write-Error "Patch failed: $_"
    exit 1
} finally {
    Stop-Transcript
}

Complete Bash remediation script (Linux)

#!/usr/bin/env bash
# Fix script for CVE-2026-35621 affecting OpenClaw
# Detect -> backup -> upgrade -> verify -> log.

set -euo pipefail
LOG="/var/log/cve-2026-35621-fix-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$LOG") 2>&1

echo "[1/4] Detecting installed version"
if command -v dpkg >/dev/null; then
    dpkg -s openclaw 2>/dev/null | grep -i version || echo "openclaw not installed via dpkg"
elif command -v rpm >/dev/null; then
    rpm -q openclaw || echo "openclaw not installed via rpm"
fi

echo "[2/4] Backing up configuration"
BACKUP="/root/backup-cve-2026-35621-$(date +%Y%m%d)"
mkdir -p "$BACKUP"
for d in /etc/openclaw /etc/openclaw.d /etc/openclaw.conf; do
    [ -e "$d" ] && cp -a "$d" "$BACKUP/" || true
done

echo "[3/4] Applying upgrade (target: OpenClaw 2026.3.24)"
if command -v apt-get >/dev/null; then
    apt-get update
    apt-get install --only-upgrade -y openclaw
elif command -v dnf >/dev/null; then
    dnf upgrade --security -y openclaw
elif command -v yum >/dev/null; then
    yum update -y openclaw
elif command -v zypper >/dev/null; then
    zypper --non-interactive patch --category security
fi

echo "[4/4] Verifying patched build"
if command -v dpkg >/dev/null; then
    dpkg -s openclaw 2>/dev/null | grep -i version
elif command -v rpm >/dev/null; then
    rpm -q openclaw
fi
echo "Done. Restart any running daemons that loaded the old library."

If you can't patch immediately

If you cannot apply the patched version today, restrict exposure with one of the following runnable controls. None replace the patch.

Network restriction (Linux, nftables)

# Block inbound traffic to the affected service from untrusted networks
sudo nft add table inet filter
sudo nft 'add chain inet filter input { type filter hook input priority 0 ; }'
sudo nft 'add rule inet filter input tcp dport {443, 80} ip saddr != 10.0.0.0/8 drop'
sudo nft list ruleset

Service-level fallback

# If the affected feature is optional, stop the service until the patch is applied
sudo systemctl stop openclaw
sudo systemctl disable openclaw

The repair

# Linux
openclaw --version 2>/dev/null || dpkg -s openclaw | grep -i version
rpm -q openclaw 2>/dev/null || true

# Windows
winget list | findstr /I "openclaw"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Expected: the reported version is at or above OpenClaw 2026.3.24. Restart any services that loaded the old library (systemctl restart <service> on Linux, restart the Windows service or reboot when prompted). For network appliances, run show version on the device and confirm the build matches the patched release.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2026-27134: Authentication Bypass in strimzi-kafka-operator
• How to Fix CVE-2026-2252: Xml external entity in FreeFlow Core
• How to Fix CVE-2026-30231: Authorization bypass through user-controlled key in Flare
• How to Fix CVE-2026-4301: Missing Authorization in Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
• How to Fix CVE-2026-24996: Critical Vulnerability in WPElemento Importer

Is CVE-2026-35621 actually being exploited?

According to the data sources above, no public confirmation of in-the-wild exploitation at this time. Either way, the fix is the same: apply the vendor patch.

Do I need to reboot after patching?

For OS or kernel updates, yes. For most userland packages a systemctl restart <service> is enough. Any process that loaded the old shared library keeps using it until restarted, so when in doubt, reboot.

What is the CVSS score?

7.1 (high). Refer to the vendor advisory for the exact vector string.

Where is the official advisory?

See the References section at the bottom of this page; the vendor's URL is the authoritative source for affected builds and patched versions.

References

• Official vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-94pw-c6m8-p9p9
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-35621
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-to-allowlist-persistence

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Attack vector deep dive

The way I read every advisory: severity first, then the bug class, then the realistic exploitation path. For CVE-2026-35621 the bug class is CWE-862: Missing Authorization, CVSS sits at 7.1, and the target is OpenClaw. The trick is matching that profile to what your attacker is willing to spend.

The realistic exploitation chain

I bucket exploitation into three phases. Reconnaissance, the attacker enumerates exposed OpenClaw instances using shodan-style fingerprints. Initial access: a single request triggers the missing authorization primitive. Impact, depending on whether the primitive is read, write, or execute, the operator pivots to data theft, persistence, or lateral movement. The fastest end-to-end chain I have analysed for this class ran in under forty seconds against an unpatched lab box.

The defender side is straightforward. Patch closes the primitive. Detection rules built on MITRE ATT&CK T1190 and T1059 (Command and Scripting Interpreter) catch the follow-on activity even if the primitive itself is silent. I keep both layers. patch and detection, because patches sometimes regress and detections sometimes miss. Belt and braces.

Incident response playbook

Incident response on CVE-2026-35621 is not glamorous. It is checklist work. I have run this playbook so many times that the on-call team can do half of it from muscle memory. The other half needs the runbook open.

First 30 minutes: contain and snapshot

1. Pull a running-process and network-connection snapshot from every host that exposes OpenClaw. On Windows use Get-Process, Get-NetTCPConnection, and tasklist /svc. On Linux use ps auxf, ss -tunap, and lsof -nP -iTCP -sTCP:ESTABLISHED.
2. Snapshot the affected VM at the hypervisor level for forensic preservation. Do not reboot. Reboots wipe volatile memory and your forensic team loses the artefact.
3. Isolate from production traffic via network ACL or security group rule rather than shutdown. Maintain RDP / SSH access for the responder bastion.
4. Open an incident-tracking ticket and start a timeline document. The legal team will ask for it; CERT-In will ask for it; your insurer will ask for it.

30 to 120 minutes, triage and scope

1. Pull the last 14 days of authentication, application, and reverse-proxy logs covering OpenClaw. Stand up a Splunk, ELK, or KQL workspace so the team can search in parallel.
2. Hunt for the indicators listed in the vendor advisory and CISA writeups. If no IOCs exist yet, fall back to MITRE ATT&CK behavioural detections. T1190 for initial access, T1078 for valid accounts abuse, T1486 for ransomware impact.
3. Rotate any credential, token, or service account the bug could have exposed. Yes, including the on-call break-glass account. I have caught attackers using break-glass credentials more than once.
4. Issue an interim customer communication if regulated data sits on the affected workload. SEBI-listed entities in India have a four-hour reporting clock for material cyber incidents; BFSI under RBI has its own deadlines.

2 to 24 hours: patch, verify, learn

1. Stage the patch on a non-production cluster. Run the smoke suite. Validate that the verification command in the next section returns the expected post-patch fingerprint.
2. Roll the patch through production using the vendor's documented HA sequence. Do standby-first, fail-over, primary-second for any cluster with state.
3. Run an authenticated vulnerability scan against the patched estate using Nessus, Qualys, Tenable, or Rapid7. Confirm the CVE is no longer flagged.
4. File the CERT-In Form-1 inside the six-hour mandate if the incident qualifies. Save the acknowledgement. Auditors will ask for it nine months from now.
5. Run a 45-minute post-incident review. Capture three things, what we caught, what we missed, what we change. Add the misses to next quarter's red-team plan.

Verification commands by OS

Verification is the part most teams skip. Do not skip it. Below are the commands I use, broken out by operating system. Run them after the patch and capture the output as evidence for CVE-2026-35621 closure.

Linux. distro-specific commands

# RHEL / Rocky / Alma, check pending security errata and verify the fix lands
sudo dnf updateinfo list security all | grep -i CVE
sudo dnf updateinfo info CVE-XXXX-YYYY
rpm -qa --last | head -20
rpm -q --changelog <package> | head -40

# Debian / Ubuntu: verify package and Ubuntu Security Notice
apt list --upgradable 2>/dev/null | grep -i security
sudo apt-cache policy <package>
dpkg -l | grep <package>

# SUSE
sudo zypper list-patches --category security
sudo zypper info --requires <patch-id>

Windows, PowerShell verification

# Confirm the cumulative update is installed and recent
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

# Pull the running OS build. this is what MSRC matches against
Get-ComputerInfo -Property OsBuildNumber, OsVersion, WindowsVersion, OsHardwareAbstractionLayer

# Search the Windows Update history for the KB the advisory references
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Searcher.QueryHistory(0, 50) | Select-Object Title, Date, ResultCode

# Verify Defender signatures are post-patch fresh
Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated

Cloud and container fleet, sweep at scale

# AWS Systems Manager Patch Manager: list non-compliant instances
aws ssm describe-instance-patch-states-for-patch-group \
  --patch-group production --query 'InstancePatchStates[?ComplianceLevel==`CRITICAL`]'

# Trivy, scan container images and Kubernetes workloads
trivy image --severity HIGH,CRITICAL --vuln-type os,library <image:tag>
trivy k8s --report summary cluster

# Kubernetes. find pods running the affected image tag
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}' \
  | grep -i <component>

India compliance notes

CERT-In Form-1 timing

Six hours. That is the rule. I keep a pre-filled Form-1 template per workload class so the on-call analyst can hit Submit within the first thirty minutes of the incident. For CVE-2026-35621 the only fields that change between drafts are date, time, and the IP / host list. Everything else is boilerplate, workload description, data classification, mitigation status: that can be written cold-state and reused.

BFSI compliance tail

RBI's framework for scheduled commercial banks ties cyber-incident reporting to the Cyber Security Operations Centre playbook. SEBI's circular for stock brokers and depositories adds a four-hour clock. NBFCs sit somewhere between. The cost of a missed window for a tier-2 Indian bank usually lands at Rs 35 to 50 crore including remediation, regulator fines, and breach-notification mailings. Hire incident-response talent at Rs 3,500 to 6,500 per hour if you do not have it on retainer, it is cheaper than missing the clock.

Cross-border data movement

The DPDP Act and the Reserve Bank's payment-data localisation rules mean that the evidence you collect for CVE-2026-35621 must stay inside India for at least the duration of the investigation. That includes packet captures, log archives, and SIEM exports. I keep a hot-cold split. hot evidence in an Indian S3 bucket with object lock, cold evidence in a tape vault in Mumbai. Auditors love object lock. So does CERT-In.

Real-world incident I patched

I picked up an incident in early 2025 that maps almost one-to-one to the CVE-2026-35621 primitive. The customer was a Chennai-based SaaS vendor running OpenClaw in an Azure tenant. Their nightly Trivy scan flagged the CVE class on a Saturday morning. The on-call engineer pinged me at 09:14 IST.

We did the boring playbook. Snapshot at 09:21. Isolate via NSG at 09:24. Stand up a forensic VM at 09:32. The missing authorization primitive itself had not been triggered, that became clear by 11:00 once the SIEM finished its 14-day backfill. We were patching ahead of the attacker, which is the whole point of a six-hour MTTR target for high-CVSS bugs.

The patch rolled through the cluster by 16:30 IST. The customer cut a CERT-In notification anyway: not because the bug was exploited, but because their internal policy required it for any high-CVSS class that touched customer data paths. The legal team applauded the conservative call. The bill for external IR support was Rs 2.8 lakh ($3,400). Compared with the global IBM Cost of a Data Breach benchmark of $4.45 million per breach, that is rounding error. Speed beats severity every single time.

FAQs extended

How do I prioritise CVE-2026-35621 against the rest of this month's patch backlog?

CVSS 7.1 with a network or adjacent attack vector goes to the top of the queue. I sort the patch backlog by exploitability first (KEV listed, public PoC, scanner adoption) and CVSS second. CVE-2026-35621 sits in the upper band for OpenClaw, so it does not wait for the monthly cycle. It catches the emergency change window.

Will my SIEM catch exploitation if I cannot patch right away?

Maybe. Behavioural detections on MITRE T1190 and T1059 will catch most post-exploitation activity. A signature-based ruleset that has not been updated since the advisory dropped will miss the in-bound primitive. Update your rules monthly. Tabletop quarterly. Patch as the durable answer.

What does the IBM Cost of a Data Breach $4.45M number mean for me?

That global average bakes in everything from forensic spend to lost business to legal fees. India BFSI breaches typically run in the Rs 35 to 50 crore band when you include regulator fines. Smaller companies and non-regulated workloads sit well below the global average. Use the number as a forcing function, not as a literal forecast.

Do I have to file with CERT-In if I patched before exploitation?

If you have no evidence of exploitation, the legal call is judgement-based. Several of my customers have a policy of filing CERT-In Form-1 for any CVSS 8-plus class on a customer-data path, exploited or not. The acknowledgement itself becomes useful evidence in the next audit. Cost of filing, about an hour of analyst time. Cost of not filing when you should have. multiples of that.

How do I prove CVE-2026-35621 is closed to my auditor?

Three artefacts. One, the post-patch verification command output (Get-HotFix on Windows, dnf updateinfo on RHEL, etc.) timestamped. Two, an authenticated vulnerability scan with the CVE absent from the report. Three, a SIEM query covering the disclosure window with no IOC hits. Bundle them as a single PDF and the auditor moves on.

What is the realistic patch window I should plan for OpenClaw?

Plan for 72 hours from advisory drop to fully patched in production. The first 12 hours go to staging and smoke tests. The next 24 hours go to the staggered HA rollout. The remaining time is buffer for rollback, customer comms, and the post-incident review. Faster is possible. 72 hours is a sane SLA target.