CVE-2026-35652

OpenClaw is affected before version 2026.3.22 by an authorization bypass in interactive callback dispatch. The flaw allows non-allowlisted senders to invoke action handlers by dispatching callbacks before normal security validation completes, enabling unauthorized actions. The CVE notes a MEDIUM ...