CVE-2026-35664: OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and reach callback handling without proper authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35664?
CVE-2026-35664 is classified as a critical severity vulnerability due to its potential for unauthorized access and exploitation.
How do I fix CVE-2026-35664?
To fix CVE-2026-35664, you should update OpenClaw to version 2026.3.25 or later.
What type of vulnerability is CVE-2026-35664?
CVE-2026-35664 is an authentication bypass vulnerability that allows attackers to mint legacy callback payloads.
Which versions of OpenClaw are affected by CVE-2026-35664?
OpenClaw versions prior to 2026.3.25 are affected by CVE-2026-35664.
What are the implications of exploiting CVE-2026-35664?
Exploitation of CVE-2026-35664 can allow unpaired recipients to bypass DM pairing restrictions, leading to potential unauthorized actions.