CVE-2026-32001: OpenClaw auth bypass enables

CISO Take

OpenClaw's shared gateway token mechanism fails to verify device identity before granting the node role over WebSocket, letting any authenticated client impersonate a trusted node and inject arbitrary agent.request and voice.transcript flows. While the CVSS score is a moderate 5.4, the EPSS places this in the top 82nd percentile for exploitation likelihood, and the low attack complexity combined with no user interaction required makes this a realistic target for opportunistic actors in multi-tenant or shared-gateway deployments. The blast radius extends to all downstream integrations relying on OpenClaw's node event pipeline — four direct dependents are tracked, but agent orchestration chains can amplify impact significantly. Organizations running OpenClaw should upgrade to version 2026.2.22 or later immediately; as an interim workaround, restrict gateway token issuance to verified device identities and audit WebSocket connection logs for unexpected role=node claims from unrecognized device IDs.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (5.4) understates operational risk in AI agent deployments. The vulnerability requires only low privileges — possession of a shared gateway token, which may be broadly distributed in multi-node OpenClaw setups — and exploits a missing authorization check (CWE-863) rather than a complex logic flaw, making it accessible to moderately skilled attackers. EPSS top-82nd-percentile exploitation probability signals real-world attacker interest. Risk escalates significantly in voice-enabled or agentic workflows where unauthorized node.event injection can silently trigger downstream AI actions with no user-visible indication.

How does the attack unfold?

Credential Acquisition

Attacker obtains a valid shared OpenClaw gateway token via configuration file exfiltration, insider access, or network interception from an existing authorized device.

AML.T0091.000

Authorization Bypass

Attacker initiates a WebSocket connection to the OpenClaw gateway using the valid token and claims role=node in the handshake; the gateway grants node role without verifying device identity (CWE-863).

AML.T0049

Agent Pipeline Injection

Attacker injects node.event calls into the OpenClaw event bus, triggering agent.request flows that queue arbitrary tasks into the AI agent's execution pipeline and accessing voice.transcript data.

AML.T0053

Impact

Unauthorized AI agent actions are executed on the attacker's behalf and sensitive voice transcript data is exfiltrated, with all activity appearing to originate from a legitimate node identity.

AML.T0108

Credential Acquisition

Attacker obtains a valid shared OpenClaw gateway token via configuration file exfiltration, insider access, or network interception from an existing authorized device.

AML.T0091.000

Authorization Bypass

Attacker initiates a WebSocket connection to the OpenClaw gateway using the valid token and claims role=node in the handshake; the gateway grants node role without verifying device identity (CWE-863).

AML.T0049

Agent Pipeline Injection

Attacker injects node.event calls into the OpenClaw event bus, triggering agent.request flows that queue arbitrary tasks into the AI agent's execution pipeline and accessing voice.transcript data.

AML.T0053

Impact

Unauthorized AI agent actions are executed on the attacker's behalf and sensitive voice transcript data is exfiltrated, with all activity appearing to originate from a legitimate node identity.

AML.T0108

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to 2026.2.22 or later (patch commit ddcb2d79b17bf2a42c5037d8aeff1537a12b931e).
Rotate all shared gateway tokens post-upgrade to invalidate any tokens potentially observed by attackers.
Enforce per-device identity verification at the gateway layer before accepting role=node claims; reject WebSocket handshakes where the claimed role does not match a cryptographically verified device identity.
Audit WebSocket connection logs for anomalous role=node connections from IPs or device identifiers not in the expected device registry.
If immediate patching is not possible, restrict network access to the WebSocket endpoint to known device IP ranges as a temporary compensating control.
Review all node.event call logs post-incident to identify any unauthorized agent.request or voice.transcript flows that may have been triggered.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.1.2 - Access control to AI systems A.8.4 - Protection of AI system inputs

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain appropriate AI oversight

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32001?

OpenClaw's shared gateway token mechanism fails to verify device identity before granting the node role over WebSocket, letting any authenticated client impersonate a trusted node and inject arbitrary agent.request and voice.transcript flows. While the CVSS score is a moderate 5.4, the EPSS places this in the top 82nd percentile for exploitation likelihood, and the low attack complexity combined with no user interaction required makes this a realistic target for opportunistic actors in multi-tenant or shared-gateway deployments. The blast radius extends to all downstream integrations relying on OpenClaw's node event pipeline — four direct dependents are tracked, but agent orchestration chains can amplify impact significantly. Organizations running OpenClaw should upgrade to version 2026.2.22 or later immediately; as an interim workaround, restrict gateway token issuance to verified device identities and audit WebSocket connection logs for unexpected role=node claims from unrecognized device IDs.

Is CVE-2026-32001 actively exploited?

No confirmed active exploitation of CVE-2026-32001 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32001?

1. Patch immediately: upgrade OpenClaw to 2026.2.22 or later (patch commit ddcb2d79b17bf2a42c5037d8aeff1537a12b931e). 2. Rotate all shared gateway tokens post-upgrade to invalidate any tokens potentially observed by attackers. 3. Enforce per-device identity verification at the gateway layer before accepting role=node claims; reject WebSocket handshakes where the claimed role does not match a cryptographically verified device identity. 4. Audit WebSocket connection logs for anomalous role=node connections from IPs or device identifiers not in the expected device registry. 5. If immediate patching is not possible, restrict network access to the WebSocket endpoint to known device IP ranges as a temporary compensating control. 6. Review all node.event call logs post-incident to identify any unauthorized agent.request or voice.transcript flows that may have been triggered.

What systems are affected by CVE-2026-32001?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration systems, voice AI pipelines, WebSocket-based AI communication layers.

What is the CVSS score for CVE-2026-32001?

CVE-2026-32001 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration systemsvoice AI pipelinesWebSocket-based AI communication layers

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.2, A.8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject unauthorized node.event calls, triggering agent.request and voice.transcript flows without proper device pairing.

Exploitation Scenario

An attacker operating within a network segment that has access to an OpenClaw gateway — for example, a compromised internal host, a rogue employee device, or an attacker who exfiltrated the shared gateway token from a configuration file — initiates a WebSocket connection to the OpenClaw gateway using the legitimate token. During the handshake, the attacker specifies role=node without presenting any device identity credential, which OpenClaw accepts due to the missing verification step. Now recognized as a trusted node, the attacker injects node.event calls that trigger agent.request flows, effectively queuing arbitrary tasks into the AI agent's execution pipeline. In voice-enabled deployments, the attacker can additionally access voice.transcript data from ongoing or historical sessions, exfiltrating sensitive spoken content without any legitimate device pairing.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.