CVE-2026-32005: OpenClaw auth bypass enables AI

CISO Take

OpenClaw versions prior to 2026.2.25 contain an incorrect authorization flaw (CWE-863) that lets any low-privileged workspace member craft interactive callbacks—block_action, view_submission, or view_closed—to bypass sender allowlists and inject arbitrary text directly into live AI agent sessions. Although CVSS scores this at 6.8 Medium and it is not in CISA KEV, EPSS places it in the top 80th percentile for exploitation likelihood; critically, AIID #1368 documents real credential-stealing abuse in the OpenClaw skills ecosystem as recently as February 2026, signaling an active attacker community already targeting this platform. In shared-workspace deployments, successful injection can drive AI agents to exfiltrate data or execute unauthorized tool calls entirely outside normal authorization controls. Teams running OpenClaw should upgrade to 2026.2.25 immediately; if patching is blocked, restrict workspace membership to trusted principals and audit callback handler logs for unauthenticated sender anomalies.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

Risk is elevated beyond the CVSS 6.8 Medium baseline for AI agent deployments. Attack complexity is rated High (AC:H), requiring precise callback crafting, but privileges required are low and no user interaction is needed, making it accessible to any insider or compromised workspace account. Confidentiality and integrity impact scores are both HIGH, meaning successful exploitation can fully compromise active agent sessions. With 396 CVEs catalogued against the same package, the OpenClaw security track record amplifies supply-chain risk. The 80th-percentile EPSS score and documented real-world attacker interest (AIID #1368) further raise operational risk well above what CVSS alone reflects.

How does the attack unfold?

Initial Access

Attacker obtains or already holds low-privileged membership in a shared OpenClaw workspace, providing the authenticated foothold required to send interactive callbacks to the platform.

AML.T0012

Authorization Bypass

Attacker crafts a block_action, view_submission, or view_closed callback omitting or spoofing the sender identity; vulnerable OpenClaw versions process it without verifying allowFrom restrictions or channel user allowlists.

AML.T0049

Session Context Poisoning

Malicious system-event text is successfully enqueued into an active AI agent session, injecting adversarial instructions directly into the agent's context window alongside legitimate session state.

AML.T0080.001

Unauthorized Agent Action

The agent processes the injected instructions as authoritative input and, depending on granted tool permissions, exfiltrates session data, invokes sensitive APIs, or executes further attacker-directed commands.

AML.T0053

Initial Access

Attacker obtains or already holds low-privileged membership in a shared OpenClaw workspace, providing the authenticated foothold required to send interactive callbacks to the platform.

AML.T0012

Authorization Bypass

Attacker crafts a block_action, view_submission, or view_closed callback omitting or spoofing the sender identity; vulnerable OpenClaw versions process it without verifying allowFrom restrictions or channel user allowlists.

AML.T0049

Session Context Poisoning

Malicious system-event text is successfully enqueued into an active AI agent session, injecting adversarial instructions directly into the agent's context window alongside legitimate session state.

AML.T0080.001

Unauthorized Agent Action

The agent processes the injected instructions as authoritative input and, depending on granted tool permissions, exfiltrates session data, invokes sensitive APIs, or executes further attacker-directed commands.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

6 steps

Upgrade OpenClaw to version 2026.2.25 or later (patch commit ce8c67c).
If immediate upgrade is not possible, restrict shared workspace membership to verified, trusted users to reduce the unauthorized callback surface.
Audit callback handler logs for requests where the sender does not match configured allowFrom entries or channel user allowlists.
Review agent tool permissions and apply least-privilege: revoke broad tool grants until patched.
Monitor agent session logs for anomalous or unexpected system-event text injections.
Reference vendor advisory GHSA-x2ff-j5c2-ggpr and the VulnCheck advisory for updated remediation details.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Prompt Injection Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0051.002 - Triggered AML.T0053 - AI Agent Tool Invocation AML.T0080.001 - Thread

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.6 - Access control for AI systems

NIST AI RMF

GOVERN 1.7 - Processes and procedures for AI risk management

OWASP LLM Top 10

LLM01 - Prompt Injection

Frequently Asked Questions

What is CVE-2026-32005?

OpenClaw versions prior to 2026.2.25 contain an incorrect authorization flaw (CWE-863) that lets any low-privileged workspace member craft interactive callbacks—block_action, view_submission, or view_closed—to bypass sender allowlists and inject arbitrary text directly into live AI agent sessions. Although CVSS scores this at 6.8 Medium and it is not in CISA KEV, EPSS places it in the top 80th percentile for exploitation likelihood; critically, AIID #1368 documents real credential-stealing abuse in the OpenClaw skills ecosystem as recently as February 2026, signaling an active attacker community already targeting this platform. In shared-workspace deployments, successful injection can drive AI agents to exfiltrate data or execute unauthorized tool calls entirely outside normal authorization controls. Teams running OpenClaw should upgrade to 2026.2.25 immediately; if patching is blocked, restrict workspace membership to trusted principals and audit callback handler logs for unauthenticated sender anomalies.

Is CVE-2026-32005 actively exploited?

No confirmed active exploitation of CVE-2026-32005 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32005?

1. Upgrade OpenClaw to version 2026.2.25 or later (patch commit ce8c67c). 2. If immediate upgrade is not possible, restrict shared workspace membership to verified, trusted users to reduce the unauthorized callback surface. 3. Audit callback handler logs for requests where the sender does not match configured allowFrom entries or channel user allowlists. 4. Review agent tool permissions and apply least-privilege: revoke broad tool grants until patched. 5. Monitor agent session logs for anomalous or unexpected system-event text injections. 6. Reference vendor advisory GHSA-x2ff-j5c2-ggpr and the VulnCheck advisory for updated remediation details.

What systems are affected by CVE-2026-32005?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Shared workspace deployments, Multi-user AI agent platforms, Event-driven agent pipelines.

What is the CVSS score for CVE-2026-32005?

CVE-2026-32005 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksShared workspace deploymentsMulti-user AI agent platformsEvent-driven agent pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0051.002 Triggered

AML.T0053 AI Agent Tool Invocation

AML.T0080.001 Thread

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM01

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared workspace deployments. Unauthorized workspace members can bypass allowFrom restrictions and channel user allowlists to enqueue system-event text into active sessions.

Exploitation Scenario

An attacker holding low-privileged membership in a shared OpenClaw workspace sends a crafted block_action callback that omits or spoofs the expected sender identifier. Because pre-patch OpenClaw does not enforce sender authorization checks, the callback bypasses the allowFrom restriction and channel user allowlist. The malicious payload—containing adversarial prompt instructions—is enqueued directly into an active AI agent session. The agent processes the injected text as legitimate system input and, depending on its tool permissions, may exfiltrate session context to an attacker-controlled endpoint, execute unintended API calls, or persist instructions for future triggers. This mirrors the credential-theft pattern observed in AIID #1368, where OpenClaw skill abuse led to AMOS stealer deployment via similar trust-model exploitation.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.