Every CVE Search/ Get API key

CVE-2026-35659

OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

5.1 MediumFix available

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.12%Up 0.1 points since Apr 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Record
CVE-2026-35659
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.6 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-345
Updated
2026-11-02
EUVDEUVD-2026-21464 5.1

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Record
EUVD-2026-21464
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rvqr-hrcc-j9vv 5.1

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Summary

Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • deecf68b59a9b7eea978e40fd3c2fe543087b569

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints.
  • src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path.

OpenClaw thanks @nexrin for reporting.

Record
GHSA-rvqr-hrcc-j9vv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.6 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-345, CWE-642
Updated
2026-11-02
NVD 5.1

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Record
CVE-2026-35659
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.6 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
OSV 5.1

OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata.

Record
CVE-2026-35659
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-345
Updated
2026-11-02
OSVGHSA-rvqr-hrcc-j9vv 5.1

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Summary

Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • deecf68b59a9b7eea978e40fd3c2fe543087b569

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints.
  • src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path.

OpenClaw thanks @nexrin for reporting.

Record
GHSA-rvqr-hrcc-j9vv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.6 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-345, CWE-642
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.3.22
2026.3.22

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35659 is a medium vulnerability (CVSS 5.1) in Openclaw, published March 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in openclaw 2026.3.22.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open