●PocketClawAI security alerts
Sign in
mediumCVSS 4.6NVD status: Analyzed

CVE-2026-35659

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed.

ComponentOpenClaw
Severitymedium (CVSS 4.6)
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published (NVD)2026-04-10
Last modified2026-06-17
Affected versions
openclaw < 2026.3.22
Fixed in2026.3.22
WeaknessCWE-345
CISA KEVnot listed

NVD description

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Does CVE-2026-35659 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for OpenClaw.
Check my stack

What to do

  • Upgrade OpenClaw to 2026.3.22 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other OpenClaw CVEs

medium
CVE-2026-108757CVSS 6.5

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips...

OpenClaw
2026-10-11high
CVE-2026-101884CVSS 7.5

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,...

OpenClaw
2026-09-30high
CVE-2026-101880CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe...

OpenClaw
2026-09-30medium
CVE-2026-101881CVSS 6.5

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th...

OpenClaw
2026-09-30medium
CVE-2026-101883CVSS 5.4

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U...

OpenClaw
2026-09-30high
CVE-2026-101882CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-exec...

OpenClaw
2026-09-30

All OpenClaw CVEs