CVE-2026-43535 | THREATINT

Description

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.

PUBLISHED Reserved 2026-05-01 | Published 2026-05-05 | Updated 2026-05-05 | Assigner VulnCheck

HIGH: 7.6CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

MEDIUM: 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-266: Incorrect Privilege Assignment

Product status

Default status

unaffected

Any version before 2026.4.14

affected

2026.4.14 (semver)

unaffected

Credits

zsx (@zsxsoft) reporter

KeenSecurityLab coordinator

qclawer tool

References

github.com/...enclaw/security/advisories/GHSA-jwrq-8g5x-5fhm (GitHub Security Advisory (GHSA-jwrq-8g5x-5fhm)) vendor-advisory

github.com/...ommit/43d4be902755c970b3d15608679761877718da69 (Patch Commit) patch

www.vulncheck.com/...ext-reuse-in-collect-mode-queue-batches (VulnCheck Advisory: OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches) third-party-advisory

cve.org (CVE-2026-43535)

nvd.nist.gov (CVE-2026-43535)

Download JSON