CVE-2026-32067: OpenClaw auth bypass enables

CISO Take

CVE-2026-32067 is an authorization bypass in OpenClaw's direct message pairing-store that allows an attacker with sender approval in one account to be silently accepted across other accounts in multi-account deployments without explicit re-authorization. Although the CVSS score is a low 3.7, the EPSS percentile places this in the top 6% of vulnerabilities most likely to be exploited — a meaningful signal for a platform carrying 396 known CVEs and a historically weak security posture. Enterprise and multi-tenant OpenClaw deployments are most exposed: the flaw creates an implicit cross-account trust relationship that entirely circumvents the intended approval workflow, meaning a compromise of one tenant can silently propagate access to adjacent tenants. Organizations running multi-account deployments should upgrade to OpenClaw 2026.2.26 immediately, audit all existing pairing-store entries for anomalous cross-account inheritance, and revoke any approvals that span unintended account boundaries.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Despite the low CVSS score (3.7), the top-6% EPSS percentile indicates meaningful real-world exploitation probability. The attack requires network access, low privileges, and user interaction — limiting opportunistic mass exploitation — but targeted abuse against multi-account enterprise deployments is plausible. OpenClaw's track record of 396 CVEs signals systemic security debt, raising the likelihood of chained exploits. The blast radius is constrained (4 direct dependents, no KEV listing, no public PoC or Nuclei template), but the authorization boundary bypass in an AI agent communication channel is qualitatively significant: an attacker who compromises one tenant effectively gains an implicit foothold into adjacent tenants without triggering standard approval workflows.

How does the attack unfold?

Initial Access

Attacker establishes or compromises a low-privilege OpenClaw account in one tenant and obtains legitimate sender pairing approval from a target account through a normal user interaction.

AML.T0012

Authorization Bypass

Attacker exploits the pairing-store flaw (CWE-863) to have their existing approval automatically inherited by a second account in the same multi-account deployment without any explicit re-authorization from Account B's user.

AML.T0049

Cross-Account Infiltration

With trusted sender status silently inherited in Account B, attacker gains an active DM channel into Account B's AI agent workflows while appearing as a pre-approved communicant.

AML.T0091.000

Impact

Attacker intercepts sensitive agent coordination messages, injects malicious instructions into trusted communication channels, or exfiltrates data surfaced by AI workflows across all affected accounts.

AML.T0025

Initial Access

Attacker establishes or compromises a low-privilege OpenClaw account in one tenant and obtains legitimate sender pairing approval from a target account through a normal user interaction.

AML.T0012

Authorization Bypass

Attacker exploits the pairing-store flaw (CWE-863) to have their existing approval automatically inherited by a second account in the same multi-account deployment without any explicit re-authorization from Account B's user.

AML.T0049

Cross-Account Infiltration

With trusted sender status silently inherited in Account B, attacker gains an active DM channel into Account B's AI agent workflows while appearing as a pre-approved communicant.

AML.T0091.000

Impact

Attacker intercepts sensitive agent coordination messages, injects malicious instructions into trusted communication channels, or exfiltrates data surfaced by AI workflows across all affected accounts.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.26 or later (patches at commits a0c5e28f and bce643a0b).
Audit: Query the pairing-store for sender entries appearing across more than one account context and flag as anomalous; revoke all unintentionally shared approvals.
Isolate: If immediate patching is not possible, disable DM pairing in multi-account deployments or enforce network-level account segmentation.
Detect: Alert on any sender account that appears in pairing-store records for multiple distinct target accounts post-audit.
Monitor: Review access logs for sender approvals granted without corresponding explicit user interaction in the receiving account.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1 - AI risk treatment

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain AI system security post-deployment

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32067?

CVE-2026-32067 is an authorization bypass in OpenClaw's direct message pairing-store that allows an attacker with sender approval in one account to be silently accepted across other accounts in multi-account deployments without explicit re-authorization. Although the CVSS score is a low 3.7, the EPSS percentile places this in the top 6% of vulnerabilities most likely to be exploited — a meaningful signal for a platform carrying 396 known CVEs and a historically weak security posture. Enterprise and multi-tenant OpenClaw deployments are most exposed: the flaw creates an implicit cross-account trust relationship that entirely circumvents the intended approval workflow, meaning a compromise of one tenant can silently propagate access to adjacent tenants. Organizations running multi-account deployments should upgrade to OpenClaw 2026.2.26 immediately, audit all existing pairing-store entries for anomalous cross-account inheritance, and revoke any approvals that span unintended account boundaries.

Is CVE-2026-32067 actively exploited?

No confirmed active exploitation of CVE-2026-32067 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32067?

1. Patch: Upgrade OpenClaw to version 2026.2.26 or later (patches at commits a0c5e28f and bce643a0b). 2. Audit: Query the pairing-store for sender entries appearing across more than one account context and flag as anomalous; revoke all unintentionally shared approvals. 3. Isolate: If immediate patching is not possible, disable DM pairing in multi-account deployments or enforce network-level account segmentation. 4. Detect: Alert on any sender account that appears in pairing-store records for multiple distinct target accounts post-audit. 5. Monitor: Review access logs for sender approvals granted without corresponding explicit user interaction in the receiving account.

What systems are affected by CVE-2026-32067?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-tenant agent deployments, Agent-to-agent communication pipelines.

What is the CVSS score for CVE-2026-32067?

CVE-2026-32067 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-tenant agent deploymentsAgent-to-agent communication pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.1

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.

Exploitation Scenario

An adversary targeting an enterprise using OpenClaw across multiple departments first social-engineers or compromises a low-privilege account in Department A's OpenClaw instance, requesting and obtaining legitimate sender pairing approval through a normal workflow. Exploiting the pairing-store authorization flaw, the attacker's approval is automatically inherited by Department B's OpenClaw account without any re-authorization step, granting an active and trusted communication channel into Department B's AI agent environment. From this position, the adversary can intercept agent coordination messages, inject malicious instructions into trusted DM channels, or exfiltrate sensitive data surfaced by the agent — all while appearing as a pre-approved sender to the receiving system.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.