CVE-2026-32021: OpenClaw auth bypass

CISO Take

OpenClaw's Feishu integration validates sender identity against an allowlist by comparing display names — a mutable, attacker-controlled field — instead of immutable user IDs, allowing any Feishu user to gain trusted-sender access simply by renaming their account to match an allowlisted string. With an EPSS percentile in the top 90%, exploitation probability is elevated well above what the moderate CVSS score alone suggests; the attack is network-accessible, requires zero privileges, and demands no user interaction, meaning any Feishu user who can reach your OpenClaw deployment is a viable threat actor. Given documented credential theft abuse in the OpenClaw ecosystem (AIID #1368), an authorization bypass that impersonates trusted senders carries real escalation risk into connected agent pipelines and downstream tooling. Patch to 2026.2.22 immediately; if patching is blocked, disable Feishu integrations and audit all `allowFrom` configurations for display-name-based entries.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.5) understates operational risk for AI agent deployments. The attack requires zero privileges, no user interaction, and is network-accessible — exploitable by any Feishu user who can identify or enumerate an allowlisted display name string. EPSS in the top 90th percentile signals disproportionate real-world exploitation likelihood relative to the raw score. The 396 prior CVEs in this package indicate a pattern of accumulated security debt that warrants elevated scrutiny. While only 4 downstream package dependents limit supply-chain blast radius, any enterprise OpenClaw deployment using Feishu as an agent communication channel faces direct unauthorized access risk with trivial exploitation complexity.

How does the attack unfold?

Reconnaissance

Attacker identifies the target OpenClaw deployment's Feishu integration and discovers allowlisted display name strings through public directories, leaked configuration files, or low-noise enumeration.

AML.T0095

Identity Spoofing

Attacker sets their Feishu account display name to exactly match an allowlisted string, exploiting CWE-863 — the agent trusts a mutable attacker-controlled field as the basis for authorization.

AML.T0074

Authorization Bypass

Attacker sends a Feishu message to the OpenClaw agent; the `allowFrom` check passes because the display name matches the allowlist, granting unauthorized trusted-sender status with no credentials required.

AML.T0049

Unauthorized Agent Access

Attacker invokes agent capabilities as a trusted sender — triggering restricted workflows, accessing privileged data in the agent's context, or issuing commands to connected tools and downstream enterprise systems.

AML.T0053

Reconnaissance

Attacker identifies the target OpenClaw deployment's Feishu integration and discovers allowlisted display name strings through public directories, leaked configuration files, or low-noise enumeration.

AML.T0095

Identity Spoofing

Attacker sets their Feishu account display name to exactly match an allowlisted string, exploiting CWE-863 — the agent trusts a mutable attacker-controlled field as the basis for authorization.

AML.T0074

Authorization Bypass

Attacker sends a Feishu message to the OpenClaw agent; the `allowFrom` check passes because the display name matches the allowlist, granting unauthorized trusted-sender status with no credentials required.

AML.T0049

Unauthorized Agent Access

Attacker invokes agent capabilities as a trusted sender — triggering restricted workflows, accessing privileged data in the agent's context, or issuing commands to connected tools and downstream enterprise systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Patch: Upgrade OpenClaw to version 2026.2.22 or later (patch commit 4ed87a66 on GitHub).
Immediate workaround: Disable the Feishu integration entirely until patching is complete.
Audit: Review all allowFrom allowlist configurations; replace any display-name-based entries with verified immutable Feishu user IDs.
Detection: Monitor Feishu message logs for unexpected senders successfully passing allowlist checks; alert on authorization grants to newly registered or recently renamed accounts.
Compensating control: Implement secondary verification (e.g., challenge-response, shared secret, or out-of-band confirmation) for sensitive agent actions triggered via Feishu messages.
Rotate: If exploitation is suspected, rotate any credentials or API keys accessible to the OpenClaw agent.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.5 - AI system access control

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32021?

OpenClaw's Feishu integration validates sender identity against an allowlist by comparing display names — a mutable, attacker-controlled field — instead of immutable user IDs, allowing any Feishu user to gain trusted-sender access simply by renaming their account to match an allowlisted string. With an EPSS percentile in the top 90%, exploitation probability is elevated well above what the moderate CVSS score alone suggests; the attack is network-accessible, requires zero privileges, and demands no user interaction, meaning any Feishu user who can reach your OpenClaw deployment is a viable threat actor. Given documented credential theft abuse in the OpenClaw ecosystem (AIID #1368), an authorization bypass that impersonates trusted senders carries real escalation risk into connected agent pipelines and downstream tooling. Patch to 2026.2.22 immediately; if patching is blocked, disable Feishu integrations and audit all `allowFrom` configurations for display-name-based entries.

Is CVE-2026-32021 actively exploited?

No confirmed active exploitation of CVE-2026-32021 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32021?

1. Patch: Upgrade OpenClaw to version 2026.2.22 or later (patch commit 4ed87a66 on GitHub). 2. Immediate workaround: Disable the Feishu integration entirely until patching is complete. 3. Audit: Review all `allowFrom` allowlist configurations; replace any display-name-based entries with verified immutable Feishu user IDs. 4. Detection: Monitor Feishu message logs for unexpected senders successfully passing allowlist checks; alert on authorization grants to newly registered or recently renamed accounts. 5. Compensating control: Implement secondary verification (e.g., challenge-response, shared secret, or out-of-band confirmation) for sensitive agent actions triggered via Feishu messages. 6. Rotate: If exploitation is suspected, rotate any credentials or API keys accessible to the OpenClaw agent.

What systems are affected by CVE-2026-32021?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, enterprise chat integrations, agentic workflows.

What is the CVSS score for CVE-2026-32021?

CVE-2026-32021 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworksenterprise chat integrationsagentic workflows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display names instead of enforcing ID-only matching. An attacker can set a display name equal to an allowlisted ID string to bypass authorization checks and gain unauthorized access.

Exploitation Scenario

An attacker discovers an organization's OpenClaw deployment uses Feishu for agent communication. Through reconnaissance — public Feishu directories, leaked configuration files, or trial-and-error enumeration — they identify a display name string present in the `allowFrom` allowlist, such as 'admin-bot', 'security-team', or a specific executive's display name. The attacker creates or modifies a Feishu account to set its display name to exactly match that allowlisted string. OpenClaw's authorization check compares the incoming message's display name against the allowlist and passes, granting trusted-sender status. The attacker now sends arbitrary commands to the OpenClaw agent — invoking privileged tool calls, exfiltrating data from the agent's context window or connected data sources, or pivoting laterally through connected enterprise systems.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.