CVE-2026-32057: OpenClaw auth bypass grants

CISO Take

OpenClaw versions prior to 2026.2.25 contain an authentication bypass in the Control UI pairing mechanism where an authenticated node-role WebSocket client can pass client.id=control-ui to skip device identity verification entirely, gaining unauthorized access to node event execution flows. This matters because OpenClaw's package history of 396 CVEs signals chronic security debt, EPSS places this in the top 75th percentile for exploitation likelihood, and a real-world incident (AIID #1368) already documents credential exfiltration via malicious OpenClaw skill abuse — indicating an adversarial ecosystem actively targeting this platform. Low attack complexity means no specialized knowledge is required once a node credential is obtained. Organizations running OpenClaw agents should patch to 2026.2.25 immediately; if patching is blocked, restrict WebSocket endpoint access to trusted network segments and audit node-role sessions for unexpected client.id values.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk for AI agent deployments using OpenClaw. The vulnerability requires only a low-privilege authenticated WebSocket session — no user interaction, no complex setup — placing effective exploitation within reach of any insider or external attacker holding a node credential. The control plane nature of the bypass means downstream blast radius extends through every tool and data source the agent is authorized to reach. The package's 396-CVE history and an existing active threat ecosystem (AIID #1368) compound the baseline EPSS signal. While not in CISA KEV, the EPSS top-75th-percentile placement and trivially low attack complexity warrant treating this as operationally urgent for any organization with network-accessible OpenClaw deployments.

How does the attack unfold?

Initial Access

Attacker obtains a valid node-role WebSocket credential via credential compromise, insider access, or malicious skill delivery as documented in AIID #1368.

AML.T0012

Authentication Bypass

Attacker connects to the trusted-proxy WebSocket endpoint and sends client.id=control-ui, causing the server to skip device identity verification and grant Control UI-level session privileges.

AML.T0049

Agent Control Hijack

With unauthorized Control UI access, the attacker injects into or redirects node event execution flows, triggering arbitrary agent tool invocations indistinguishable from legitimate activity.

AML.T0053

Impact

Attacker exfiltrates data, manipulates agent outputs, or pivots laterally through APIs, databases, and file systems the compromised agent is authorized to access.

AML.T0086

Initial Access

Attacker obtains a valid node-role WebSocket credential via credential compromise, insider access, or malicious skill delivery as documented in AIID #1368.

AML.T0012

Authentication Bypass

Attacker connects to the trusted-proxy WebSocket endpoint and sends client.id=control-ui, causing the server to skip device identity verification and grant Control UI-level session privileges.

AML.T0049

Agent Control Hijack

With unauthorized Control UI access, the attacker injects into or redirects node event execution flows, triggering arbitrary agent tool invocations indistinguishable from legitimate activity.

AML.T0053

Impact

Attacker exfiltrates data, manipulates agent outputs, or pivots laterally through APIs, databases, and file systems the compromised agent is authorized to access.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I High

A None

What should I do?

5 steps

Patch immediately to OpenClaw 2026.2.25 (commit ec45c317f5 addresses the bypass; validate against the vendor advisory GHSA-vvgp-4c28-m3jm).
If patching is blocked, enforce network-layer ACLs restricting the trusted-proxy WebSocket endpoint to known Control UI source IPs — application-layer bypass cannot be exploited if the endpoint is unreachable from unauthorized clients.
Audit active and historical WebSocket sessions for client.id=control-ui originating from non-Control UI sources; treat any confirmed match as a security incident requiring forensic review.
Review agent execution logs since 2026-03-21 (publication date) for anomalous node event sequences — particularly unexpected tool calls or data access patterns.
Rotate all node-role WebSocket credentials as a precautionary measure given the AIID #1368 credential exfiltration precedent in this ecosystem.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms exist to respond to and recover from identified AI risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32057?

OpenClaw versions prior to 2026.2.25 contain an authentication bypass in the Control UI pairing mechanism where an authenticated node-role WebSocket client can pass client.id=control-ui to skip device identity verification entirely, gaining unauthorized access to node event execution flows. This matters because OpenClaw's package history of 396 CVEs signals chronic security debt, EPSS places this in the top 75th percentile for exploitation likelihood, and a real-world incident (AIID #1368) already documents credential exfiltration via malicious OpenClaw skill abuse — indicating an adversarial ecosystem actively targeting this platform. Low attack complexity means no specialized knowledge is required once a node credential is obtained. Organizations running OpenClaw agents should patch to 2026.2.25 immediately; if patching is blocked, restrict WebSocket endpoint access to trusted network segments and audit node-role sessions for unexpected client.id values.

Is CVE-2026-32057 actively exploited?

No confirmed active exploitation of CVE-2026-32057 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32057?

1. Patch immediately to OpenClaw 2026.2.25 (commit ec45c317f5 addresses the bypass; validate against the vendor advisory GHSA-vvgp-4c28-m3jm). 2. If patching is blocked, enforce network-layer ACLs restricting the trusted-proxy WebSocket endpoint to known Control UI source IPs — application-layer bypass cannot be exploited if the endpoint is unreachable from unauthorized clients. 3. Audit active and historical WebSocket sessions for client.id=control-ui originating from non-Control UI sources; treat any confirmed match as a security incident requiring forensic review. 4. Review agent execution logs since 2026-03-21 (publication date) for anomalous node event sequences — particularly unexpected tool calls or data access patterns. 5. Rotate all node-role WebSocket credentials as a precautionary measure given the AIID #1368 credential exfiltration precedent in this ecosystem.

What systems are affected by CVE-2026-32057?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration systems, AI agent control planes.

What is the CVSS score for CVE-2026-32057?

CVE-2026-32057 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration systemsAI agent control planes

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Exploitation Scenario

An attacker obtains a node-role WebSocket credential — through prior compromise, an insider threat, or abuse of the OpenClaw skills ecosystem (per AIID #1368 precedent where ~17% of third-party skills were assessed as malicious). They connect to the trusted-proxy WebSocket endpoint and include client.id=control-ui in their handshake, bypassing the pairing verification that normally gates Control UI access. The server accepts the identifier without verifying device identity, granting Control UI-level privileges. The attacker now controls node event execution flows: they can trigger tool calls the agent is authorized to make, intercept or tamper with event data, or pivot to downstream systems accessible via the agent's configured toolset — all appearing as legitimate agent activity in execution logs, making detection without dedicated session monitoring highly unlikely.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.