CVE-2026-35666 HIGH

CVE-2026-35666: OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper

Vendor Openclaw

Product OpenClaw

Weakness CWE-706

Published April 10, 2026

Last update April 13, 2026

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inner commands.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-35666 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/706.html

Related vulnerabilities

04Related CVE

CVE-2026-25890 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL CVE-2026-41402 OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass CVE-2023-42125 Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability CVE-2026-41354 OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys CVE-2026-1230 Use of Incorrectly-Resolved Name or Reference in GitLab