CWE-636: Not Failing Securely ('Failing Open')

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."

Consequences

• Access Control: Bypass Protection Mechanism

How to prevent it

• Architecture and Design: Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.

Recent advisories

• EEF-CVE-2026-103502 — hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
• EEF-CVE-2026-82744 — Ash.Reactor change step fails open, skipping a change when its where guard raises
• EEF-CVE-2026-68746 — Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
• GHSA-qvw7-jm5c-6hqw — Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
• GO-2026-5128 — Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
• GHSA-8mg9-j9cf-54cj — OpenClaw: Empty-scope device re-pairing could confuse caller scope containment
• GHSA-gp79-m99v-gjmh — OpenClaw: Mattermost handlers could fall open when channel type was missing
• GHSA-vcgp-9326-pqcp — net-imap vulnerable to STARTTLS stripping via invalid response timing
• GHSA-q2gc-xjqw-qp89 — OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts
• GHSA-w85g-3h6x-4xh2 — OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS
• GHSA-cwq8-6f96-g3q4 — OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)
• GHSA-qvr7-g57c-mrc7 — OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
• GHSA-g233-2p4r-3q7v — Hashicorp Vault vulnerable to denial of service through memory exhaustion
• GHSA-j2rp-gmqv-frhv — HashiCorpVault does not correctly validate OCSP responses
• GHSA-232p-vwff-86mp — Docker Swarm encrypted overlay network may be unauthenticated

All advisories for CWE-636