CVE-2026-35617: OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName

Q: What is the severity of CVE-2026-35617?

CVE-2026-35617 is classified as a medium severity vulnerability due to its potential for exploitation in authorization bypass scenarios.

Q: How do I fix CVE-2026-35617?

To mitigate CVE-2026-35617, upgrade OpenClaw to version 2026.3.25 or later.

Q: What type of vulnerability is CVE-2026-35617?

CVE-2026-35617 is an authorization bypass vulnerability that affects group policy enforcement.

Q: What are the affected versions for CVE-2026-35617?

CVE-2026-35617 affects OpenClaw versions prior to 2026.3.25.

Q: Can CVE-2026-35617 be exploited remotely?

Yes, CVE-2026-35617 can be exploited remotely if an attacker can manipulate group policies through mutable space display names.

Published Apr 9, 2026

Updated

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.

Affected Software

2 affected components

OpenClaw OpenClaw<2026.3.25

OpenClaw Openclaw Node.js<2026.3.25

Remediation

Patch Available

https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff

Event History

Apr 9, 2026

CVE Published

via MITRE·09:26 PM

Data Sourced

via MITRE·09:26 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-35617?

CVE-2026-35617 is classified as a medium severity vulnerability due to its potential for exploitation in authorization bypass scenarios.

How do I fix CVE-2026-35617?