CVE-2026-32027: OpenClaw authorization bypass

CISO Take

OpenClaw versions before 2026.2.26 contain a CWE-863 authorization bypass where identities approved for direct message pairing are incorrectly accepted as valid senders for group allowlist checks, allowing any DM-paired party to read group conversations they were never explicitly granted access to. The CVSS confidentiality impact is rated High with a fully network-accessible, low-complexity, low-privilege attack vector requiring no user interaction — and EPSS places this in the top 85th percentile for exploitation likelihood relative to all published CVEs, despite no current public exploit or CISA KEV listing. AI agent deployments using OpenClaw group channels for orchestration, inter-agent messaging, or data sharing are directly at risk of confidentiality breach at the communication layer. Upgrade to 2026.2.26+ immediately using the patches at commits 8bdda7a and 051fdcc; in the interim, audit all DM pairing relationships and verify that no paired identity appears implicitly in group contexts.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck AIID

What is the risk?

Medium overall severity (CVSS 6.5) but with an attacker-favorable profile: network vector, low complexity, low privileges, no user interaction, and high confidentiality impact. The EPSS 85th percentile placement is meaningful — it signals elevated real-world exploitation probability relative to the vast majority of published CVEs, even though the absolute probability (0.24%) remains low. No active exploitation evidence and no public exploit or Nuclei scanner template reduce immediate urgency slightly. However, for AI agent platforms where group channels carry sensitive orchestration instructions or inter-agent data, the blast radius of even a quiet exploitation is significant. The package has 396 other CVEs in its history, suggesting an ongoing security debt pattern worth factoring into vendor trust decisions.

How does the attack unfold?

Initial Access

Attacker establishes a legitimate DM pairing with any user or agent on the OpenClaw platform using a low-privilege account, a standard onboarding action that raises no alerts.

AML.T0012

Authorization Bypass

Attacker sends a message to a restricted group channel; OpenClaw's flawed logic evaluates the DM-paired identity against groupAllowFrom and incorrectly grants access.

AML.T0049

Data Collection

Attacker reads sensitive group messages including agent orchestration instructions, tool call outputs, in-band credentials, and proprietary data shared among authorized group members.

AML.T0085

Exfiltration

Harvested data — API keys, agent configurations, research outputs, or user data — is exfiltrated to adversary-controlled infrastructure via standard network channels.

AML.T0025

Initial Access

Attacker establishes a legitimate DM pairing with any user or agent on the OpenClaw platform using a low-privilege account, a standard onboarding action that raises no alerts.

AML.T0012

Authorization Bypass

Attacker sends a message to a restricted group channel; OpenClaw's flawed logic evaluates the DM-paired identity against groupAllowFrom and incorrectly grants access.

AML.T0049

Data Collection

Attacker reads sensitive group messages including agent orchestration instructions, tool call outputs, in-band credentials, and proprietary data shared among authorized group members.

AML.T0085

Exfiltration

Harvested data — API keys, agent configurations, research outputs, or user data — is exfiltrated to adversary-controlled infrastructure via standard network channels.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw 2026.2.26+ (commits 8bdda7a651c21e98 and 051fdcc428129446 address the flaw).
Audit DM pairing relationships: export all current pairings and remove any that lack a documented business justification — each pairing is now an implicit potential group reader.
Review groupAllowFrom configurations: treat any identity not explicitly present in groupAllowFrom as unauthorized and verify your group channels have not been accessed by unexpected senders.
Enable message-level audit logging if available: look for group messages from senders not listed in the configured allowlist as an IOC for prior exploitation.
If immediate patching is blocked by change control, consider disabling group messaging or switching to a default-deny posture at the network perimeter until the patch can be applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0085 - Data from AI Services AML.T0091 - Use Alternate Authentication Material AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.8.4 - Security of AI systems

NIST AI RMF

GOVERN 1.1 - Policies and practices for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32027?

OpenClaw versions before 2026.2.26 contain a CWE-863 authorization bypass where identities approved for direct message pairing are incorrectly accepted as valid senders for group allowlist checks, allowing any DM-paired party to read group conversations they were never explicitly granted access to. The CVSS confidentiality impact is rated High with a fully network-accessible, low-complexity, low-privilege attack vector requiring no user interaction — and EPSS places this in the top 85th percentile for exploitation likelihood relative to all published CVEs, despite no current public exploit or CISA KEV listing. AI agent deployments using OpenClaw group channels for orchestration, inter-agent messaging, or data sharing are directly at risk of confidentiality breach at the communication layer. Upgrade to 2026.2.26+ immediately using the patches at commits 8bdda7a and 051fdcc; in the interim, audit all DM pairing relationships and verify that no paired identity appears implicitly in group contexts.

Is CVE-2026-32027 actively exploited?

No confirmed active exploitation of CVE-2026-32027 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32027?

1. Patch immediately: upgrade to OpenClaw 2026.2.26+ (commits 8bdda7a651c21e98 and 051fdcc428129446 address the flaw). 2. Audit DM pairing relationships: export all current pairings and remove any that lack a documented business justification — each pairing is now an implicit potential group reader. 3. Review groupAllowFrom configurations: treat any identity not explicitly present in groupAllowFrom as unauthorized and verify your group channels have not been accessed by unexpected senders. 4. Enable message-level audit logging if available: look for group messages from senders not listed in the configured allowlist as an IOC for prior exploitation. 5. If immediate patching is blocked by change control, consider disabling group messaging or switching to a default-deny posture at the network perimeter until the patch can be applied.

What systems are affected by CVE-2026-32027?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, AI orchestration platforms.

What is the CVSS score for CVE-2026-32027?

CVE-2026-32027 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsAI orchestration platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0085 Data from AI Services

AML.T0091 Use Alternate Authentication Material

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.8.4

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.

Exploitation Scenario

An attacker creates or compromises a low-privilege account on an OpenClaw-based enterprise AI agent platform and establishes a DM pairing with a legitimate user or agent — a normal, unremarkable onboarding step. The platform has restricted group channels used by a fleet of AI agents to share orchestration commands, tool credentials, and proprietary research outputs, protected by strict groupAllowFrom allowlists. The attacker then sends messages to those restricted groups. OpenClaw's flawed authorization logic evaluates the DM-paired identity against the group allowlist and incorrectly treats the pairing as satisfying the check. The attacker gains read access to all group messages — including agent instructions carrying API keys, database queries, or internal decision data — without ever appearing in groupAllowFrom. Because no user interaction is required and the check is purely server-side, this can be automated across all discoverable group channels in a single scripted pass.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.