CVE-2026-32006: OpenClaw auth bypass — LOW

CISO Take

OpenClaw prior to version 2026.2.26 contains an authorization logic flaw that allows DM-paired identities to be incorrectly accepted as members of group allowlists when both dmPolicy=pairing and groupPolicy=allowlist are active simultaneously. A remote attacker with an existing DM pairing relationship can send unauthorized messages and reactions into restricted group channels without being explicitly listed in groupAllowFrom, effectively impersonating an authorized group member. While CVSS severity is low (3.1) and no public exploit exists, the EPSS score places this in the top 79th percentile for exploitation likelihood — disproportionately high for a 3.1 score — and 4 downstream packages inherit this exposure. Organizations using OpenClaw group allowlist controls should upgrade to 2026.2.26 immediately; as an interim workaround, avoid running both dmPolicy=pairing and groupPolicy=allowlist together, and audit group message sources for DM-paired identities lacking explicit groupAllowFrom entries.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Low severity by CVSS (3.1), but with above-average real-world exploitation likelihood per EPSS (79th percentile), which is unusually elevated for this score. High attack complexity — requiring an existing DM pairing relationship — significantly constrains the attacker pool. Impact is limited to integrity (no confidentiality or availability loss), scoped to the application boundary. However, the vulnerable policy combination (dmPolicy=pairing plus groupPolicy=allowlist) is architecturally common in enterprise multi-agent deployments that rely on DM-based trust establishment followed by role-based group access controls. No KEV inclusion and no public exploit reduce immediate urgency, but the EPSS signal warrants patching on a normal patch cycle.

How does the attack unfold?

Establish DM Pairing

Attacker creates or leverages an existing legitimate DM pairing relationship with the target OpenClaw instance to obtain a valid pairing-store identity recognized by the system.

AML.T0012

Trigger Authorization Bypass

Attacker sends a message or reaction targeting a group channel protected by groupPolicy=allowlist; OpenClaw incorrectly validates the DM pairing identity as an authorized group allowlist member.

AML.T0049

Unauthorized Group Access

Message is delivered to the restricted group channel without the attacker being listed in groupAllowFrom, collapsing the intended access control boundary between DM and group trust domains.

AML.T0053

Impact — Integrity Violation

Attacker injects unauthorized instructions, false context, or reactions into controlled agent communication spaces, potentially manipulating multi-agent workflows or influencing AI agent behavior within privileged group channels.

Establish DM Pairing

Attacker creates or leverages an existing legitimate DM pairing relationship with the target OpenClaw instance to obtain a valid pairing-store identity recognized by the system.

AML.T0012

Trigger Authorization Bypass

Attacker sends a message or reaction targeting a group channel protected by groupPolicy=allowlist; OpenClaw incorrectly validates the DM pairing identity as an authorized group allowlist member.

AML.T0049

Unauthorized Group Access

Message is delivered to the restricted group channel without the attacker being listed in groupAllowFrom, collapsing the intended access control boundary between DM and group trust domains.

AML.T0053

Impact — Integrity Violation

Attacker injects unauthorized instructions, false context, or reactions into controlled agent communication spaces, potentially manipulating multi-agent workflows or influencing AI agent behavior within privileged group channels.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.26 or later (patch commit 051fdcc4 closes the logic flaw).
If immediate upgrade is not feasible, reconfigure to avoid the concurrent use of dmPolicy=pairing and groupPolicy=allowlist — changing either policy breaks the vulnerable code path.
Audit all groupAllowFrom membership lists and cross-reference against active DM pairing-store identities to surface any unexpected overlaps already in place.
Enable message-source logging in OpenClaw to detect messages originating from DM-paired identities reaching restricted group channels.
Extend patching assessment to the four downstream dependents that embed OpenClaw and may inherit the flawed authorization logic.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9(2)(b) - Risk management — technical robustness and security

ISO 42001

A.6.1.3 - Access control to AI system resources

NIST AI RMF

GOVERN-1.2 - AI risk and benefit management accountability

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32006?

OpenClaw prior to version 2026.2.26 contains an authorization logic flaw that allows DM-paired identities to be incorrectly accepted as members of group allowlists when both dmPolicy=pairing and groupPolicy=allowlist are active simultaneously. A remote attacker with an existing DM pairing relationship can send unauthorized messages and reactions into restricted group channels without being explicitly listed in groupAllowFrom, effectively impersonating an authorized group member. While CVSS severity is low (3.1) and no public exploit exists, the EPSS score places this in the top 79th percentile for exploitation likelihood — disproportionately high for a 3.1 score — and 4 downstream packages inherit this exposure. Organizations using OpenClaw group allowlist controls should upgrade to 2026.2.26 immediately; as an interim workaround, avoid running both dmPolicy=pairing and groupPolicy=allowlist together, and audit group message sources for DM-paired identities lacking explicit groupAllowFrom entries.

Is CVE-2026-32006 actively exploited?

No confirmed active exploitation of CVE-2026-32006 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32006?

1. Upgrade OpenClaw to version 2026.2.26 or later (patch commit 051fdcc4 closes the logic flaw). 2. If immediate upgrade is not feasible, reconfigure to avoid the concurrent use of dmPolicy=pairing and groupPolicy=allowlist — changing either policy breaks the vulnerable code path. 3. Audit all groupAllowFrom membership lists and cross-reference against active DM pairing-store identities to surface any unexpected overlaps already in place. 4. Enable message-source logging in OpenClaw to detect messages originating from DM-paired identities reaching restricted group channels. 5. Extend patching assessment to the four downstream dependents that embed OpenClaw and may inherit the flawed authorization logic.

What systems are affected by CVE-2026-32006?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, multi-agent communication pipelines, access-controlled agent messaging systems.

What is the CVSS score for CVE-2026-32006?

CVE-2026-32006 has a CVSS v3.1 base score of 3.1 (LOW). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmulti-agent communication pipelinesaccess-controlled agent messaging systems

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 9(2)(b)

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN-1.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. Remote attackers can send messages and reactions as DM-paired identities without explicit groupAllowFrom membership to bypass group sender authorization checks.

Exploitation Scenario

An adversary who has established a legitimate DM pairing with an OpenClaw-based AI agent — through normal onboarding, a prior social engineering step, or compromise of a low-privilege account — sends a crafted message targeting a restricted group channel protected by groupPolicy=allowlist. Because the affected versions incorrectly validate the sender's DM pairing identity as satisfying the groupAllowFrom check, the message bypasses authorization and is delivered to the group. In a multi-agent deployment, the adversary can now inject instructions, false context, or reactions into a privileged agent communication space — potentially manipulating downstream agent behavior, poisoning shared agent context, or escalating influence within a multi-agent workflow without ever obtaining explicit group membership.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.