CVE-2026-35624

Summary

OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.

Affected Software

VendorProductVersion RangeStatus
OpenClawOpenClaw0 < 2026.3.22affected
OpenClawOpenClaw2026.3.22unaffected

Weaknesses

  • CWE-807: CWE-807 Reliance on Untrusted Inputs in a Security Decision

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References