CVE-2026-32051: OpenClaw auth bypass lets operators

CISO Take

CVE-2026-32051 is a privilege escalation flaw in OpenClaw, an AI agent platform, where authenticated users holding only `operator.write` scope can invoke owner-restricted control-plane surfaces — specifically gateway and cron management — during agent execution in scoped-token deployments. The root cause is inconsistent authorization gating: owner-only checks are enforced in some paths but bypassed when the same operations are triggered through agent runs, a subtle but exploitable trust boundary collapse. With a CVSS of 8.8, no user interaction required, and low attack complexity, any attacker who holds or steals valid `operator.write` credentials can silently reconfigure routing or job scheduling and effectively assume owner-level control of the AI infrastructure; EPSS places this in the top 67th percentile for exploitation likelihood despite the absence of a public proof-of-concept. Organizations running OpenClaw in multi-tenant or role-separated deployments should upgrade immediately to version 2026.3.1, and as an interim measure restrict `operator.write` scope to fully trusted principals while auditing agent execution logs for unexpected gateway or cron invocations.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk for any deployment relying on OpenClaw's scoped-token model for multi-tenant isolation or privilege separation. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) means the attack is trivially reachable over the network by any authenticated user with the lowest non-public permission level, with no social engineering or user interaction needed. The absence of a public exploit and non-KEV status reduce immediate mass-exploitation risk, but the low barrier means insider threat actors or attackers who have phished an operator credential can escalate silently. The 396 CVEs previously catalogued in this package indicate an actively researched attack surface, raising the probability that researchers are already probing this specific class of authorization logic. Blast radius within a single deployment is high — control-plane ownership over gateway and cron effectively grants attacker-controlled scheduling and routing of all AI agent workloads.

How does the attack unfold?

Credential Acquisition

Attacker obtains valid operator.write credentials via insider access, phishing, or credential theft from a compromised CI/CD pipeline or developer workstation.

AML.T0012

Authorization Bypass

Attacker submits a crafted agent run request through the OpenClaw API, exploiting inconsistent owner-only gating to invoke gateway and cron tool surfaces reserved for owner scope.

AML.T0049

Control-Plane Takeover

With owner-equivalent access achieved, attacker invokes gateway reconfiguration and cron manipulation to redirect agent tool calls to adversary-controlled infrastructure.

AML.T0053

Persistent AI Workflow Manipulation

Attacker modifies agent configuration to persist malicious routing or scheduling, enabling ongoing data interception, workflow suppression, or injection of unauthorized agent runs.

AML.T0081

Credential Acquisition

Attacker obtains valid operator.write credentials via insider access, phishing, or credential theft from a compromised CI/CD pipeline or developer workstation.

AML.T0012

Authorization Bypass

Attacker submits a crafted agent run request through the OpenClaw API, exploiting inconsistent owner-only gating to invoke gateway and cron tool surfaces reserved for owner scope.

AML.T0049

Control-Plane Takeover

With owner-equivalent access achieved, attacker invokes gateway reconfiguration and cron manipulation to redirect agent tool calls to adversary-controlled infrastructure.

AML.T0053

Persistent AI Workflow Manipulation

Attacker modifies agent configuration to persist malicious routing or scheduling, enabling ongoing data interception, workflow suppression, or injection of unauthorized agent runs.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to version 2026.3.1 or later, which closes the authorization mismatch in agent run gating.
Short-term workaround if patching is delayed: remove operator.write scope from all service accounts and human operators not explicitly requiring it; treat all operator.write principals as effectively owner-equivalent until patched.
Detection: query agent execution logs for invocations of gateway and cron tool surfaces by principals holding only operator.write scope — legitimate pre-patch usage should be negligible; any such calls warrant investigation.
Review audit trails for scoped-token issuance and revoke any tokens with operator.write scope that are not actively needed.
If OpenClaw is behind an API gateway, consider adding an authorization layer that enforces owner-only gating at the perimeter as a defense-in-depth measure until the patch is applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.2 - AI system roles and responsibilities A.9.4 - AI system access control

NIST AI RMF

GOVERN-1.2 - Policies and procedures are in place for accountability MANAGE-2.2 - Mechanisms exist to respond to identified risks

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32051?

CVE-2026-32051 is a privilege escalation flaw in OpenClaw, an AI agent platform, where authenticated users holding only `operator.write` scope can invoke owner-restricted control-plane surfaces — specifically gateway and cron management — during agent execution in scoped-token deployments. The root cause is inconsistent authorization gating: owner-only checks are enforced in some paths but bypassed when the same operations are triggered through agent runs, a subtle but exploitable trust boundary collapse. With a CVSS of 8.8, no user interaction required, and low attack complexity, any attacker who holds or steals valid `operator.write` credentials can silently reconfigure routing or job scheduling and effectively assume owner-level control of the AI infrastructure; EPSS places this in the top 67th percentile for exploitation likelihood despite the absence of a public proof-of-concept. Organizations running OpenClaw in multi-tenant or role-separated deployments should upgrade immediately to version 2026.3.1, and as an interim measure restrict `operator.write` scope to fully trusted principals while auditing agent execution logs for unexpected gateway or cron invocations.

Is CVE-2026-32051 actively exploited?

No confirmed active exploitation of CVE-2026-32051 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32051?

1. Patch immediately: upgrade OpenClaw to version 2026.3.1 or later, which closes the authorization mismatch in agent run gating. 2. Short-term workaround if patching is delayed: remove `operator.write` scope from all service accounts and human operators not explicitly requiring it; treat all `operator.write` principals as effectively owner-equivalent until patched. 3. Detection: query agent execution logs for invocations of `gateway` and `cron` tool surfaces by principals holding only `operator.write` scope — legitimate pre-patch usage should be negligible; any such calls warrant investigation. 4. Review audit trails for scoped-token issuance and revoke any tokens with `operator.write` scope that are not actively needed. 5. If OpenClaw is behind an API gateway, consider adding an authorization layer that enforces owner-only gating at the perimeter as a defense-in-depth measure until the patch is applied.

What systems are affected by CVE-2026-32051?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, orchestration pipelines, model serving, multi-tenant AI deployments, scheduled AI workflows.

What is the CVSS score for CVE-2026-32051?

CVE-2026-32051 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksorchestration pipelinesmodel servingmulti-tenant AI deploymentsscheduled AI workflows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.2, A.9.4

NIST AI RMF: GOVERN-1.2, MANAGE-2.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attackers with write-scope access can perform control-plane actions beyond their intended authorization level by exploiting inconsistent owner-only gating during agent execution.

Exploitation Scenario

An adversary (insider, compromised contractor, or attacker who phished an operator credential) authenticates to OpenClaw with a legitimate `operator.write` token. They craft an agent run request — a normal API call in this context — that targets gateway reconfiguration endpoints typically reserved for owners. Because the authorization check in the agent execution path does not enforce the owner-only gate consistently, the request succeeds. The adversary reconfigures the gateway to route a subset of agent tool calls to an attacker-controlled external endpoint, enabling passive interception of sensitive data flowing through the AI agent pipeline. Separately, they modify cron schedules to inject additional agent runs at off-hours, providing persistent execution capability. The entire attack leaves no obvious anomaly in access logs beyond routine agent run activity, making detection difficult without fine-grained tool-surface auditing.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.