CVE-2026-35638

The record

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less allow path in the trusted-proxy mechanism to maintain elevated permissions by declaring arbitrary scopes, bypassing device identity requirements.

Affected packages

Related vulnerabilities

• CVE-2025-64725 Weblate has improper validation upon invitation acceptance CWE-286
• GHSA-m6hq-f4w9-qrjj Weblate has improper validation upon invitation acceptance CWE-286
• CVE-2025-64521 authentik allows a deactivated Service account to authenticate to OAuth CWE-286