CVE-2026-43535
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
May 05, 2026
Vendor
unknown
Description
OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.