CVE-2026-43535CWE-266

OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches

High · published May 5, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches
    cvelistv5