CVE-2026-32050: OpenClaw auth bypass — LOW

CISO Take

OpenClaw versions prior to 2026.2.25 contain an incorrect authorization flaw (CWE-863) in its signal reaction notification handler, allowing unauthenticated network attackers to enqueue status events into sessions they have no DM or group access to — effectively injecting data into AI agent communication channels before access controls are applied. While CVSS rates this Low at 3.7, the EPSS score places this CVE in the top 89th percentile for exploitation likelihood, and the package carries 396 registered CVEs — a pattern that signals chronic security hygiene issues in the codebase rather than an isolated finding. No public exploit or CISA KEV listing exists as of publication, and the high attack complexity requirement limits opportunistic mass exploitation, but the zero-privilege requirement lowers the barrier for targeted attacks against known deployments. Organizations running OpenClaw in AI agent pipelines should upgrade to 2026.2.25 immediately, review patch commit 2aa7842, and audit logs for unauthorized signal reaction attempts against restricted sessions.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Despite a low CVSS score of 3.7, this vulnerability warrants disproportionate attention in AI agent environments. The EPSS 89th-percentile rating suggests elevated community-assessed exploitation probability relative to the broader CVE population. Attack complexity is high (AC:H), requiring precise knowledge of the vulnerable reaction-only event path and likely some reconnaissance of the target deployment — limiting automated scanning exploitation. Impact is confined to integrity (I:L), meaning attackers can inject status events but cannot exfiltrate session data or cause denial of service. The 4-downstream-dependent footprint limits supply chain blast radius significantly. However, the package's track record of 396 CVEs represents a systemic risk that goes beyond this individual finding and should inform any continued dependency decision.

How does the attack unfold?

Reconnaissance

Attacker identifies an exposed OpenClaw deployment and maps its signal notification API surface using the public vendor advisory and patch commit to locate the vulnerable reaction-only event path.

AML.T0006

Authorization Bypass

Attacker sends a crafted signal reaction notification to a target restricted session; event-handler.ts enqueues the status event before DM or group access validation is applied, bypassing access controls entirely.

AML.T0049

Status Event Injection

Attacker-controlled status lines are inserted into the target session's event queue and processed as if they originated from an authorized sender.

AML.T0053

Impact

Agent workflows relying on status events receive manipulated input, leading to corrupted coordination state, unintended downstream agent actions, or an established covert signaling channel into protected sessions.

AML.T0048

Reconnaissance

Attacker identifies an exposed OpenClaw deployment and maps its signal notification API surface using the public vendor advisory and patch commit to locate the vulnerable reaction-only event path.

AML.T0006

Authorization Bypass

Attacker sends a crafted signal reaction notification to a target restricted session; event-handler.ts enqueues the status event before DM or group access validation is applied, bypassing access controls entirely.

AML.T0049

Status Event Injection

Attacker-controlled status lines are inserted into the target session's event queue and processed as if they originated from an authorized sender.

AML.T0053

Impact

Agent workflows relying on status events receive manipulated input, leading to corrupted coordination state, unintended downstream agent actions, or an established covert signaling channel into protected sessions.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.25 or later; patch commit 2aa7842adeedef423be7ce283a9144b9f1a0a669 resolves the deferred authorization check in event-handler.ts.
If immediate patching is not feasible, apply network-level controls to restrict access to OpenClaw signal notification endpoints to known trusted senders only.
Review event-handler.ts for any remaining instances where authorization checks are applied after event enqueue rather than before.
Audit application logs for unexpected signal reaction notifications from senders lacking DM or group access to the target session.
Given the package's history of 396 CVEs, conduct a broader security review of OpenClaw's role in your environment and evaluate whether its risk profile justifies continued use or migration to an alternative AI agent communication layer.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place for monitoring risk over time

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32050?

OpenClaw versions prior to 2026.2.25 contain an incorrect authorization flaw (CWE-863) in its signal reaction notification handler, allowing unauthenticated network attackers to enqueue status events into sessions they have no DM or group access to — effectively injecting data into AI agent communication channels before access controls are applied. While CVSS rates this Low at 3.7, the EPSS score places this CVE in the top 89th percentile for exploitation likelihood, and the package carries 396 registered CVEs — a pattern that signals chronic security hygiene issues in the codebase rather than an isolated finding. No public exploit or CISA KEV listing exists as of publication, and the high attack complexity requirement limits opportunistic mass exploitation, but the zero-privilege requirement lowers the barrier for targeted attacks against known deployments. Organizations running OpenClaw in AI agent pipelines should upgrade to 2026.2.25 immediately, review patch commit 2aa7842, and audit logs for unauthorized signal reaction attempts against restricted sessions.

Is CVE-2026-32050 actively exploited?

No confirmed active exploitation of CVE-2026-32050 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32050?

1. Upgrade OpenClaw to version 2026.2.25 or later; patch commit 2aa7842adeedef423be7ce283a9144b9f1a0a669 resolves the deferred authorization check in event-handler.ts. 2. If immediate patching is not feasible, apply network-level controls to restrict access to OpenClaw signal notification endpoints to known trusted senders only. 3. Review event-handler.ts for any remaining instances where authorization checks are applied after event enqueue rather than before. 4. Audit application logs for unexpected signal reaction notifications from senders lacking DM or group access to the target session. 5. Given the package's history of 396 CVEs, conduct a broader security review of OpenClaw's role in your environment and evaluate whether its risk profile justifies continued use or migration to an alternative AI agent communication layer.

What systems are affected by CVE-2026-32050?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-agent communication systems, Agent-to-agent messaging pipelines.

What is the CVSS score for CVE-2026-32050?

CVE-2026-32050 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-agent communication systemsAgent-to-agent messaging pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.

Exploitation Scenario

An adversary identifies an OpenClaw deployment exposed on the network and enumerates its signal notification API surface via the vendor advisory to locate the reaction-only event path in event-handler.ts. The attacker sends a crafted signal reaction notification targeting a high-value session — for example, one belonging to an AI orchestration agent managing sensitive workflow decisions. The vulnerable event path accepts and enqueues the status event before the DM or group access validation is applied, successfully injecting attacker-controlled status lines into the target session queue. Downstream agent logic interprets these injected events as legitimate coordination signals, potentially triggering unintended workflow actions, corrupting orchestration state, or creating a persistent covert channel through which the attacker can influence agent behavior across repeated interactions.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.