CVE-2026-32035: OpenClaw auth bypass grants

CISO Take

OpenClaw versions before 2026.3.2 contain an authorization flaw in the Discord voice transcript handler: when agentCommand processes voice channel input, it omits the senderIsOwner flag, which defaults to true and silently grants any voice participant full owner-level bot permissions. While the base CVSS score is 5.9 (Medium), the EPSS percentile places this vulnerability in the top 96% most likely to see real-world exploitation—an unusual divergence that warrants immediate attention regardless of the moderate base score. Organizations running OpenClaw in mixed-trust Discord channels are directly exposed: an attacker with basic channel membership can invoke gateway configuration and cron scheduling functions without authorization, enabling persistent automation abuse or service disruption beyond the initial session. Upgrade to 2026.3.2 immediately; if patching is delayed, restrict bot deployment to owner-controlled channels only and audit recent cron job and gateway changes for unauthorized modifications.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

The CVSS 5.9 (Medium) understates urgency relative to the EPSS top-96% percentile signal. High attack complexity and required user interaction reflect Discord voice channel constraints, but in shared enterprise or community servers these preconditions are routinely satisfied with minimal effort. The integrity impact is rated High—gateway and cron manipulation can persist beyond the initial access event and affect downstream automation. With 4 downstream dependents, blast radius is currently narrow, but organizations in regulated sectors using OpenClaw for operational AI agent automation face meaningful compliance exposure if unauthorized privileged tool invocations go undetected.

How does the attack unfold?

Initial Access

Attacker joins a mixed-trust Discord voice channel where an OpenClaw-powered bot is active, requiring only standard channel membership with no elevated privileges.

AML.T0049

Privilege Escalation

Attacker submits voice transcript input triggering agentCommand; the missing senderIsOwner flag defaults to true, silently granting owner-level permissions to the non-owner participant.

AML.T0053

Unauthorized Tool Invocation

With owner privileges established, attacker invokes restricted gateway and cron tools to modify bot connectivity and inject scheduled commands into the agent's automation loop.

AML.T0053

Persistence & Impact

Injected cron jobs persist the attacker's commands across sessions; gateway modifications add malicious webhooks or redirect bot traffic, maintaining durable control over the agent's operations.

Initial Access

Attacker joins a mixed-trust Discord voice channel where an OpenClaw-powered bot is active, requiring only standard channel membership with no elevated privileges.

AML.T0049

Privilege Escalation

Attacker submits voice transcript input triggering agentCommand; the missing senderIsOwner flag defaults to true, silently granting owner-level permissions to the non-owner participant.

AML.T0053

Unauthorized Tool Invocation

With owner privileges established, attacker invokes restricted gateway and cron tools to modify bot connectivity and inject scheduled commands into the agent's automation loop.

AML.T0053

Persistence & Impact

Injected cron jobs persist the attacker's commands across sessions; gateway modifications add malicious webhooks or redirect bot traffic, maintaining durable control over the agent's operations.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C Low

I High

A Low

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw 2026.3.2 or later, which correctly passes the senderIsOwner flag in agentCommand.
If patching is delayed: restrict bot deployment to private channels where all participants are explicitly trusted owners; disable gateway and cron tools via bot configuration.
Detection: audit bot activity logs for gateway modification or cron creation events attributed to non-owner user IDs; search for agentCommand invocations originating from voice channel participants who are not channel owners during the vulnerable period.
Rotate any credentials or tokens accessible through gateway functionality if unauthorized access is suspected.
Review ClawHub-sourced skills for signs of secondary abuse enabled by elevated bot permissions (see AIID #1368).

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.001 - Tool Definitions

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2.4 - Access control for AI systems

NIST AI RMF

GOVERN-6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32035?

OpenClaw versions before 2026.3.2 contain an authorization flaw in the Discord voice transcript handler: when agentCommand processes voice channel input, it omits the senderIsOwner flag, which defaults to true and silently grants any voice participant full owner-level bot permissions. While the base CVSS score is 5.9 (Medium), the EPSS percentile places this vulnerability in the top 96% most likely to see real-world exploitation—an unusual divergence that warrants immediate attention regardless of the moderate base score. Organizations running OpenClaw in mixed-trust Discord channels are directly exposed: an attacker with basic channel membership can invoke gateway configuration and cron scheduling functions without authorization, enabling persistent automation abuse or service disruption beyond the initial session. Upgrade to 2026.3.2 immediately; if patching is delayed, restrict bot deployment to owner-controlled channels only and audit recent cron job and gateway changes for unauthorized modifications.

Is CVE-2026-32035 actively exploited?

No confirmed active exploitation of CVE-2026-32035 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32035?

1. Patch immediately: upgrade to OpenClaw 2026.3.2 or later, which correctly passes the senderIsOwner flag in agentCommand. 2. If patching is delayed: restrict bot deployment to private channels where all participants are explicitly trusted owners; disable gateway and cron tools via bot configuration. 3. Detection: audit bot activity logs for gateway modification or cron creation events attributed to non-owner user IDs; search for agentCommand invocations originating from voice channel participants who are not channel owners during the vulnerable period. 4. Rotate any credentials or tokens accessible through gateway functionality if unauthorized access is suspected. 5. Review ClawHub-sourced skills for signs of secondary abuse enabled by elevated bot permissions (see AIID #1368).

What systems are affected by CVE-2026-32035?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, Discord-integrated AI agents, mixed-trust channel automation.

What is the CVSS score for CVE-2026-32035?

CVE-2026-32035 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

agent frameworksDiscord-integrated AI agentsmixed-trust channel automation

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.001 Tool Definitions

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.4

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron functionality in mixed-trust channels.

Exploitation Scenario

An attacker joins a mixed-trust Discord voice channel where an OpenClaw bot is active—typical in vendor collaboration servers, open developer communities, or shared enterprise workspaces. When the attacker speaks or submits a voice transcript that triggers agentCommand, the missing senderIsOwner flag causes the authorization check to treat the attacker as the channel owner. The attacker then invokes the gateway tool to modify bot connectivity—adding malicious webhooks or redirecting traffic—and abuses cron scheduling to inject recurring commands, establishing persistent execution within the agent's automation loop without any credential theft or social engineering of an actual owner.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.