CVE-2026-35663: OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

March 27, 2026 (updated April 10, 2026)

Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

References

github.com/advisories/GHSA-9hjh-fr4f-gxc4
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d3d8e316bd819d3c7e34253aeb7eccb2510f5f48
github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4
nvd.nist.gov/vuln/detail/CVE-2026-35663

Code Behaviors & Features

Detect and mitigate CVE-2026-35663 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →