CVE-2026-35619
OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint
Résumé
OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model metadata through the HTTP compatibility route, bypassing the stricter WebSocket RPC authorization checks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com