CVE-2026-35648: OpenClaw may have stale policy enforcement for queued node actions
(updated )
Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening.
References
- github.com/advisories/GHSA-wj55-88gf-x564
- github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
- github.com/openclaw/openclaw/commit/ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2
- github.com/openclaw/openclaw/security/advisories/GHSA-wj55-88gf-x564
- nvd.nist.gov/vuln/detail/CVE-2026-35648
- www.vulncheck.com/advisories/openclaw-policy-bypass-via-unvalidated-queued-node-actions
Code Behaviors & Features
Detect and mitigate CVE-2026-35648 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →