CVE-2026-32895: OpenClaw auth bypass circumvents

CISO Take

OpenClaw, a Slack-integrated AI agent framework, fails to enforce sender authorization in system event handlers for message_changed, message_deleted, and thread_broadcast events, enabling any low-privileged Slack workspace member to bypass configured DM and per-channel allowlists and trigger unauthorized agent actions. While the CVSS score is medium (5.4) and only 4 downstream packages depend on it, the vulnerability sits in the top 92nd EPSS percentile — a signal of elevated exploitation likelihood for this class of authorization flaw — and OpenClaw's 396-CVE history indicates systemic security debt that should prompt a broader trust review of this package in your environment. No public exploits or CISA KEV listing exist at this time, but the low attack complexity and minimal privilege barrier make opportunistic exploitation realistic for any workspace participant. Patch to OpenClaw 2026.2.26 or later; if immediate patching is not possible, audit Slack workspace membership and tighten allowlist configurations as an interim control.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Medium overall, with contextual elevators that warrant prompt action. The vulnerability requires only low privileges (any authenticated Slack workspace member) and no user interaction, with low attack complexity — exploitation demands no specialized skill beyond basic Slack API familiarity. Impact is bounded at C:L/I:L and the 4-dependent package footprint limits blast radius in most environments. However, the 92nd-percentile EPSS score signals above-average exploitation likelihood for this authorization class, and OpenClaw's 396-CVE backlog is a significant systemic risk indicator that suggests inadequate security practices in the project overall. For organizations deploying OpenClaw agents with broad tool access — APIs, data stores, code execution environments — the effective impact can materially exceed the CVSS base score, as agent capabilities amplify the consequences of any unauthorized trigger.

How does the attack unfold?

Workspace Presence Confirmed

Attacker, already a low-privilege member of the target Slack workspace, observes OpenClaw bot presence in channels or DMs, confirming a viable attack surface and identifying which event types activate the agent.

AML.T0084.002

Crafted System Events Injected

Attacker sends message_changed, message_deleted, or thread_broadcast Slack system events from their non-allowlisted account, exploiting OpenClaw's failure to validate sender identity in these event subtypes.

AML.T0049

Unauthorized Agent Execution

OpenClaw enqueues and processes the crafted events as legitimate, executing agent logic and invoking connected tools or data sources beyond the attacker's authorized scope.

AML.T0053

Data Access or Workflow Manipulation

Depending on agent configuration, attacker reads from internal data repositories, injects content into agent-driven workflows, or executes unauthorized actions through the agent's tool integrations.

AML.T0085.001

Workspace Presence Confirmed

Attacker, already a low-privilege member of the target Slack workspace, observes OpenClaw bot presence in channels or DMs, confirming a viable attack surface and identifying which event types activate the agent.

AML.T0084.002

Crafted System Events Injected

Attacker sends message_changed, message_deleted, or thread_broadcast Slack system events from their non-allowlisted account, exploiting OpenClaw's failure to validate sender identity in these event subtypes.

AML.T0049

Unauthorized Agent Execution

OpenClaw enqueues and processes the crafted events as legitimate, executing agent logic and invoking connected tools or data sources beyond the attacker's authorized scope.

AML.T0053

Data Access or Workflow Manipulation

Depending on agent configuration, attacker reads from internal data repositories, injects content into agent-driven workflows, or executes unauthorized actions through the agent's tool integrations.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Patch immediately: Upgrade OpenClaw to version 2026.2.26 or later, which enforces sender authorization across all event subtypes including message_changed, message_deleted, and thread_broadcast.
Restrict workspace access: Audit Slack workspace membership and remove users who should not be able to interact with OpenClaw-integrated channels or DMs.
Review allowlists: Validate that DM and per-channel allowlist configurations reflect current, intended access only.
Apply least privilege: Audit which tools and data sources your OpenClaw agent can access; revoke any permissions not actively required.
Monitor: Alert on OpenClaw events processed from senders not present in configured allowlists as a detective control pending patch.
Evaluate long-term posture: Given 396 CVEs attributed to this package, assess whether OpenClaw meets your organization's security bar for AI agent infrastructure before expanding its deployment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.8.6 - Cybersecurity of AI systems

NIST AI RMF

MANAGE 2.4 - Mechanisms for AI risk findings incorporation

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32895?

OpenClaw, a Slack-integrated AI agent framework, fails to enforce sender authorization in system event handlers for message_changed, message_deleted, and thread_broadcast events, enabling any low-privileged Slack workspace member to bypass configured DM and per-channel allowlists and trigger unauthorized agent actions. While the CVSS score is medium (5.4) and only 4 downstream packages depend on it, the vulnerability sits in the top 92nd EPSS percentile — a signal of elevated exploitation likelihood for this class of authorization flaw — and OpenClaw's 396-CVE history indicates systemic security debt that should prompt a broader trust review of this package in your environment. No public exploits or CISA KEV listing exist at this time, but the low attack complexity and minimal privilege barrier make opportunistic exploitation realistic for any workspace participant. Patch to OpenClaw 2026.2.26 or later; if immediate patching is not possible, audit Slack workspace membership and tighten allowlist configurations as an interim control.

Is CVE-2026-32895 actively exploited?

No confirmed active exploitation of CVE-2026-32895 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32895?

1. Patch immediately: Upgrade OpenClaw to version 2026.2.26 or later, which enforces sender authorization across all event subtypes including message_changed, message_deleted, and thread_broadcast. 2. Restrict workspace access: Audit Slack workspace membership and remove users who should not be able to interact with OpenClaw-integrated channels or DMs. 3. Review allowlists: Validate that DM and per-channel allowlist configurations reflect current, intended access only. 4. Apply least privilege: Audit which tools and data sources your OpenClaw agent can access; revoke any permissions not actively required. 5. Monitor: Alert on OpenClaw events processed from senders not present in configured allowlists as a detective control pending patch. 6. Evaluate long-term posture: Given 396 CVEs attributed to this package, assess whether OpenClaw meets your organization's security bar for AI agent infrastructure before expanding its deployment.

What systems are affected by CVE-2026-32895?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, Slack-integrated AI agent pipelines, enterprise chat automation workflows.

What is the CVSS score for CVE-2026-32895?

CVE-2026-32895 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksSlack-integrated AI agent pipelinesenterprise chat automation workflows

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.8.6

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued. Attackers can bypass Slack DM allowlists and per-channel user allowlists by sending system events from non-allowlisted senders through message_changed, message_deleted, and thread_broadcast events.

Exploitation Scenario

An adversary with a standard Slack account in the target workspace observes that OpenClaw is integrated and responding in specific channels or DMs. Knowing that OpenClaw's event handlers for message_changed, message_deleted, and thread_broadcast subtypes do not validate sender identity, the adversary crafts and injects these system event types from their non-allowlisted account. OpenClaw enqueues and processes the events as if originating from an authorized sender, executing the agent's configured logic — which may include tool invocations such as querying internal databases, calling external APIs, or posting responses to restricted channels. The attacker effectively hijacks the AI agent's capabilities without ever being granted explicit access, using Slack's own event infrastructure as the attack vector to achieve unauthorized data access or workflow manipulation.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.