CVE-2026-32039: OpenClaw auth bypass grants

CISO Take

CVE-2026-32039 is an authorization bypass in OpenClaw's toolsBySender policy engine that allows any low-privileged user to impersonate a higher-privileged sender by forcing an identifier collision using mutable identity fields (senderName or senderUsername), thereby inheriting elevated tool permissions without authorization. Although the CVSS score is 5.9, the vulnerability ranks in the 91st EPSS percentile — signaling disproportionately high real-world exploitation interest for an AI agent framework whose tools commonly touch file systems, external APIs, and databases. OpenClaw has a documented track record of ecosystem abuse (AIID #1368: malicious skills delivering credential stealers in early 2026), making authorization boundary failures in this package especially consequential. Teams running OpenClaw should upgrade immediately to version 2026.2.22 per the vendor advisory; until patched, restrict toolsBySender policies to immutable, cryptographically verifiable sender identifiers and enable tool-invocation logging to detect anomalous cross-privilege calls.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Moderate CVSS (5.9) understates operational risk for AI agent deployments. The attack requires only network access and a low-privilege account — both attainable in multi-tenant or shared-agent environments common in enterprise agentic pipelines. The 91st EPSS percentile signals active adversary interest in this class of vulnerability. Impact is rated High on Integrity (I:H) because gaining unauthorized privileged tool access allows actions far exceeding an attacker's authorization level. For organizations running OpenClaw in agentic workflows connected to sensitive tools (code execution, file I/O, API integrations, database access), effective operational risk should be treated as HIGH regardless of base CVSS score.

How does the attack unfold?

Enumeration

Attacker with a low-privilege OpenClaw account queries the agent API or monitors observable message metadata to identify senderName and senderUsername values belonging to higher-privileged agents or users.

AML.T0084.001

Identity Collision

Attacker crafts or renames their agent identity to match a privileged sender's mutable identifier, exploiting the absence of type enforcement in OpenClaw's untyped sender key handling.

AML.T0107

Privilege Escalation

OpenClaw's toolsBySender policy engine incorrectly resolves the attacker's colliding identity against the privileged sender's policy group, granting inherited elevated tool permissions.

AML.T0053

Privileged Tool Execution

Attacker invokes privileged tools — such as file access, external API calls, database queries, or code execution — far beyond their authorized scope, achieving arbitrary elevated actions within the agent framework.

AML.T0053

Enumeration

Attacker with a low-privilege OpenClaw account queries the agent API or monitors observable message metadata to identify senderName and senderUsername values belonging to higher-privileged agents or users.

AML.T0084.001

Identity Collision

Attacker crafts or renames their agent identity to match a privileged sender's mutable identifier, exploiting the absence of type enforcement in OpenClaw's untyped sender key handling.

AML.T0107

Privilege Escalation

OpenClaw's toolsBySender policy engine incorrectly resolves the attacker's colliding identity against the privileged sender's policy group, granting inherited elevated tool permissions.

AML.T0053

Privileged Tool Execution

Attacker invokes privileged tools — such as file access, external API calls, database queries, or code execution — far beyond their authorized scope, achieving arbitrary elevated actions within the agent framework.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I High

A None

What should I do?

6 steps

Upgrade to OpenClaw 2026.2.22 or later (patch commit 5547a2275cb69413af3b62c795b93214fe913b57 resolves the untyped sender key issue).
Until patched, replace senderName/senderUsername-based policy keys with immutable, cryptographically verifiable sender identifiers (signed tokens or UUIDs that cannot be replicated or forced into collision).
Audit all toolsBySender policy configurations to enumerate which tools are scoped to privileged senders and quantify blast radius.
Enable comprehensive logging on tool invocations and alert on any tool call from a sender outside its expected permission group.
Apply least-privilege: ensure default tool permissions are minimal and require explicit elevation rather than inheritance.
In multi-agent deployments, validate sender identity at the infrastructure layer (mTLS or signed agent tokens) rather than relying solely on application-level identity fields.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0084.001 - Tool Definitions AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.5 - AI system access controls

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32039?

CVE-2026-32039 is an authorization bypass in OpenClaw's toolsBySender policy engine that allows any low-privileged user to impersonate a higher-privileged sender by forcing an identifier collision using mutable identity fields (senderName or senderUsername), thereby inheriting elevated tool permissions without authorization. Although the CVSS score is 5.9, the vulnerability ranks in the 91st EPSS percentile — signaling disproportionately high real-world exploitation interest for an AI agent framework whose tools commonly touch file systems, external APIs, and databases. OpenClaw has a documented track record of ecosystem abuse (AIID #1368: malicious skills delivering credential stealers in early 2026), making authorization boundary failures in this package especially consequential. Teams running OpenClaw should upgrade immediately to version 2026.2.22 per the vendor advisory; until patched, restrict toolsBySender policies to immutable, cryptographically verifiable sender identifiers and enable tool-invocation logging to detect anomalous cross-privilege calls.

Is CVE-2026-32039 actively exploited?

No confirmed active exploitation of CVE-2026-32039 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32039?

1. Upgrade to OpenClaw 2026.2.22 or later (patch commit 5547a2275cb69413af3b62c795b93214fe913b57 resolves the untyped sender key issue). 2. Until patched, replace senderName/senderUsername-based policy keys with immutable, cryptographically verifiable sender identifiers (signed tokens or UUIDs that cannot be replicated or forced into collision). 3. Audit all toolsBySender policy configurations to enumerate which tools are scoped to privileged senders and quantify blast radius. 4. Enable comprehensive logging on tool invocations and alert on any tool call from a sender outside its expected permission group. 5. Apply least-privilege: ensure default tool permissions are minimal and require explicit elevation rather than inheritance. 6. In multi-agent deployments, validate sender identity at the infrastructure layer (mTLS or signed agent tokens) rather than relying solely on application-level identity fields.

What systems are affected by CVE-2026-32039?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-agent orchestration systems, Tool-enabled LLM pipelines, Agentic automation workflows.

What is the CVSS score for CVE-2026-32039?

CVE-2026-32039 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-agent orchestration systemsTool-enabled LLM pipelinesAgentic automation workflows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0084.001 Tool Definitions

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender keys by forcing collisions with mutable identity values such as senderName or senderUsername to bypass sender-authorization policies and gain unauthorized access to privileged tools.

Exploitation Scenario

An attacker with a low-privilege OpenClaw account queries the agent's API or monitors observable message metadata to enumerate the senderName or senderUsername values of privileged agents (e.g., an admin orchestrator or a CISO-scoped compliance agent). The attacker then creates or renames their agent identity to match the privileged sender's mutable identifier, exploiting the absence of type enforcement in OpenClaw's toolsBySender policy engine. When the attacker's agent requests a tool invocation, the untyped key collision causes OpenClaw to incorrectly resolve the attacker's identity against the privileged sender's policy group, granting inherited elevated permissions. The attacker now executes privileged tool calls — reading sensitive files, querying connected databases, triggering external API webhooks, or escalating within a multi-agent pipeline — entirely outside their authorized scope and without triggering standard authorization failures.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.