CVE-2026-35630

Published May 29th, 2026

View on NVD ↗

CVSS v3

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

openclaw/openclaw

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

GitHub

380K