Openclaw cli: OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing (CVE-2026-35664)
Description
A vulnerability in the openclaw-cli package (versions up to 2026.3.24) allows Feishu raw card send surface to mint legacy card callbacks that bypass DM pairing, enabling unpaired recipients to reach callback handling. This issue was fixed in version 2026.3.25 by rejecting legacy raw-card command payloads to enforce normal paired callback paths.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw-cli package versions up to 2026.3.24 contain a vulnerability where Feishu raw card sends could mint legacy callback payloads that bypass device message (DM) pairing. This flaw allowed callbacks to be handled by unpaired recipients, potentially circumventing intended pairing security controls. The vulnerability was addressed by commit 81c45976db532324b5a0918a70decc19520dc354, which rejects legacy raw-card command payloads, ensuring callbacks follow the normal paired path. The fix was introduced in version 2026.3.25.
Potential Impact
Unpaired recipients could receive and handle callbacks that should have been restricted to paired devices, potentially leading to unauthorized callback processing. The exact impact depends on the use of callback handling in the affected environment but involves bypassing pairing security mechanisms.
Mitigation Recommendations
Upgrade openclaw-cli to version 2026.3.25 or later, where the vulnerability is fixed by rejecting legacy raw-card command payloads. No additional mitigation is required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-35664
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
Threat ID: 6ac245a912601ec6a3166225
Added to database: 10/04/2026, 12:25:13 UTC
Last enriched: 10/04/2026, 12:53:30 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.