CVE-2026-32014: OpenClaw metadata spoofing bypasses

CISO Take

OpenClaw versions before 2026.2.26 allow an attacker with any valid paired node identity on the trusted network to spoof reconnect metadata fields (platform and deviceFamily) that are accepted without cryptographic binding to the device-auth signature, enabling bypass of platform-based node command policies and unauthorized access to restricted agent commands. With a CVSS of 8.0 and an EPSS at the 91st percentile, exploitation likelihood is meaningfully elevated despite the absence of a public exploit or CISA KEV listing — and the package's history of 396 tracked CVEs signals a persistent security deficit that attackers are likely aware of. The adjacent network attack vector limits internet-scale exposure, but insider threats and compromised internal nodes are a realistic risk in enterprise OpenClaw deployments. Upgrade to 2026.2.26 immediately, rotate paired node credentials on sensitive nodes, and enforce network ACLs to restrict which hosts can initiate reconnect sessions.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk for organizations running OpenClaw-based AI agent infrastructure. Low attack complexity and no user interaction requirement lower the exploitation bar significantly once any foothold exists on the trusted network. The 91st percentile EPSS indicates elevated exploitation likelihood relative to the broader CVE population. Although no public exploit exists today, the target is an AI agent framework — a category with high attacker interest — and the package's 396 historical CVEs suggest a pattern of poor security hygiene that increases the probability of weaponization. Organizations in regulated sectors using OpenClaw for agentic workflows face both operational and compliance exposure if unpatched.

How does the attack unfold?

Initial Access

Attacker operates from the trusted network holding any valid OpenClaw paired node identity — whether as an insider, a compromised host, or a laterally moved node.

AML.T0012

Identity Spoofing

Attacker crafts a reconnect request asserting a higher-privileged platform or deviceFamily value, exploiting the absent signature binding to have the server accept fabricated metadata.

AML.T0074

Policy Bypass

Server classifies the attacker's node under a different platform-based command policy, granting access to restricted commands normally denied to the attacker's actual node class.

AML.T0107

Restricted Command Execution

Attacker invokes restricted agent commands — administrative tool calls, cross-agent data queries, or memory operations — expanding their foothold within the AI agent mesh.

AML.T0053

Initial Access

Attacker operates from the trusted network holding any valid OpenClaw paired node identity — whether as an insider, a compromised host, or a laterally moved node.

AML.T0012

Identity Spoofing

Attacker crafts a reconnect request asserting a higher-privileged platform or deviceFamily value, exploiting the absent signature binding to have the server accept fabricated metadata.

AML.T0074

Policy Bypass

Server classifies the attacker's node under a different platform-based command policy, granting access to restricted commands normally denied to the attacker's actual node class.

AML.T0107

Restricted Command Execution

Attacker invokes restricted agent commands — administrative tool calls, cross-agent data queries, or memory operations — expanding their foothold within the AI agent mesh.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Adjacent

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade all OpenClaw instances to version 2026.2.26 or later (commit 7d8aeaaf06e2).
Workaround if patching is delayed: restrict reconnect endpoint access via network ACLs to known trusted node IPs only and minimize nodes with active paired identities.
Audit: Review OpenClaw command policy configurations to identify which restricted commands are protected by platform checks — these are the primary exploitation targets.
Detection: Monitor reconnect events for platform or deviceFamily values inconsistent with the known fleet profile; alert on first-seen platform strings from established node IDs.
Hygiene: Rotate paired node credentials on sensitive nodes and decommission paired identities no longer in active use.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system access control

NIST AI RMF

MANAGE 2.2 - AI risk treatments — prioritize and implement responses

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32014?

OpenClaw versions before 2026.2.26 allow an attacker with any valid paired node identity on the trusted network to spoof reconnect metadata fields (platform and deviceFamily) that are accepted without cryptographic binding to the device-auth signature, enabling bypass of platform-based node command policies and unauthorized access to restricted agent commands. With a CVSS of 8.0 and an EPSS at the 91st percentile, exploitation likelihood is meaningfully elevated despite the absence of a public exploit or CISA KEV listing — and the package's history of 396 tracked CVEs signals a persistent security deficit that attackers are likely aware of. The adjacent network attack vector limits internet-scale exposure, but insider threats and compromised internal nodes are a realistic risk in enterprise OpenClaw deployments. Upgrade to 2026.2.26 immediately, rotate paired node credentials on sensitive nodes, and enforce network ACLs to restrict which hosts can initiate reconnect sessions.

Is CVE-2026-32014 actively exploited?

No confirmed active exploitation of CVE-2026-32014 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32014?

1. Patch: Upgrade all OpenClaw instances to version 2026.2.26 or later (commit 7d8aeaaf06e2). 2. Workaround if patching is delayed: restrict reconnect endpoint access via network ACLs to known trusted node IPs only and minimize nodes with active paired identities. 3. Audit: Review OpenClaw command policy configurations to identify which restricted commands are protected by platform checks — these are the primary exploitation targets. 4. Detection: Monitor reconnect events for platform or deviceFamily values inconsistent with the known fleet profile; alert on first-seen platform strings from established node IDs. 5. Hygiene: Rotate paired node credentials on sensitive nodes and decommission paired identities no longer in active use.

What systems are affected by CVE-2026-32014?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-node agent orchestration, Agent-to-agent communication meshes, Agentic AI pipelines with tiered command access.

What is the CVSS score for CVE-2026-32014?

CVE-2026-32014 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-node agent orchestrationAgent-to-agent communication meshesAgentic AI pipelines with tiered command access

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect metadata to bypass platform-based node command policies and gain access to restricted commands.

Exploitation Scenario

An attacker operating on the enterprise internal network — whether an insider, a compromised workstation, or a host reached via lateral movement — holds or obtains a valid OpenClaw paired node identity, a credential common to any legitimate agent node. During a reconnect handshake, the attacker crafts a request asserting a different, higher-privileged platform value (e.g., claiming to be an admin-class coordinator rather than a worker node). Because OpenClaw prior to 2026.2.26 does not include platform and deviceFamily in the device-auth signature, the server accepts the spoofed metadata at face value. The attacker's node is now classified under a privileged command policy, granting access to restricted commands — such as administrative tool invocations, cross-agent memory queries, or data access operations — that would normally be denied to a worker-class node, expanding foothold within the AI agent mesh.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.