PT-2026-31981

CVE-2026-35670

Published

2026-03-26

Updated

2026-04-10

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains a webhook reply delivery issue that allows attackers to redirect chat replies to unintended users. This is possible because the system uses mutable username matching instead of stable numeric user identifiers. By manipulating username changes, attackers can redirect webhook-triggered replies, bypassing the intended recipient binding recorded in webhook events.

Recommendations Update to version 2026.3.22 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key