OpenClaw releases prior to 2026.3.22 contain an authorization bypass flaw in the interactive callback dispatch mechanism. The flaw, classified as CWE-696 (Incorrect Authorization), allows senders that are not on the allowed list to trigger callbacks before the application’s normal security validation completes, enabling them to invoke arbitrary action handlers. This can lead to execution of unauthorized actions that the system should not permit, compromising the integrity of the application and potentially exposing sensitive data or altering system state.

The vulnerability affects the OpenClaw product from the OpenClaw organization. All versions earlier than 2026.3.22 are vulnerable and should be verified for compliance with this requirement.

The CVSS score of 6.9 indicates a moderate to high risk level. Since no EPSS score is available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, the likelihood of widespread exploitation remains uncertain. Based on the description, the likely attack vector is remote, where an attacker can send crafted callback requests to trigger the authorization bypass before standard validation is performed. The impact would be the unauthorized execution of privileged actions, potentially leading to data exposure or system compromise.