CVE-2026-32897: OpenClaw auth token leak

CISO Take

OpenClaw prior to 2026.2.22 reuses the gateway authentication token as the fallback HMAC secret for owner-ID obfuscation in system prompts, meaning any party with visibility into prompts forwarded to third-party LLM providers can cryptanalytically recover the master gateway credential. Although the CVSS score is 3.7 (Low), EPSS places this in the top 83rd percentile for exploitation likelihood — a rate that outpaces most medium-severity CVEs — and a successfully derived token grants full gateway authentication, not merely disclosure of obfuscated owner IDs. No public exploit exists and only 4 tracked downstream dependents constrain the immediate blast radius, but any OpenClaw deployment with commands.ownerDisplay=hash and an unset ownerDisplaySecret is silently misconfigured by default. Upgrade to 2026.2.22 immediately; as an interim workaround, explicitly set commands.ownerDisplaySecret to a cryptographically independent value, rotate gateway.auth.token, and audit gateway authentication logs for anomalous access patterns.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 3.7 (Low) materially underrepresents operational risk: the vulnerability enables full recovery of the gateway authentication credential rather than limited information disclosure. EPSS top-83rd percentile indicates statistical exploitation likelihood exceeding most medium-rated CVEs. Attack complexity is rated High, requiring an adversary to already have read access to system prompts in transit — achievable through third-party provider access, shared logging infrastructure, or a compromised prompt pipeline. With 396 other CVEs catalogued in the same package and only 4 tracked downstream dependents, organizational exposure depends heavily on whether gateway prompts traverse untrusted intermediaries and whether operator configurations leave ownerDisplaySecret unset.

How does the attack unfold?

Prompt Observation

Attacker gains read access to system prompts forwarded from OpenClaw to a third-party LLM provider via provider-side logs, shared infrastructure, or a compromised logging pipeline.

AML.T0069.002

Token Derivation

Attacker collects multiple hashed owner-ID values from observed prompts and performs cryptanalytic analysis to recover the static gateway.auth.token reused as the HMAC secret across all hash operations.

AML.T0055

Gateway Authentication

Attacker uses the derived gateway.auth.token to authenticate directly to the OpenClaw API, bypassing user-level access controls without triggering standard authentication alerts.

AML.T0012

Backend Credential Access

Authenticated to the gateway, attacker accesses all configured model provider routes, downstream API keys, and agent tool integrations, enabling lateral movement across the full AI infrastructure layer.

AML.T0083

Prompt Observation

Attacker gains read access to system prompts forwarded from OpenClaw to a third-party LLM provider via provider-side logs, shared infrastructure, or a compromised logging pipeline.

AML.T0069.002

Token Derivation

Attacker collects multiple hashed owner-ID values from observed prompts and performs cryptanalytic analysis to recover the static gateway.auth.token reused as the HMAC secret across all hash operations.

AML.T0055

Gateway Authentication

Attacker uses the derived gateway.auth.token to authenticate directly to the OpenClaw API, bypassing user-level access controls without triggering standard authentication alerts.

AML.T0012

Backend Credential Access

Authenticated to the gateway, attacker accesses all configured model provider routes, downstream API keys, and agent tool integrations, enabling lateral movement across the full AI infrastructure layer.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

6 steps

Upgrade OpenClaw to 2026.2.22 or later — the patch introduces separate key material for the owner-ID hash function, eliminating the dual-use of the gateway token.
If immediate patching is not feasible, explicitly set commands.ownerDisplaySecret to a cryptographically random string independent of gateway.auth.token.
Rotate gateway.auth.token after patching to invalidate any credentials that may have been derived prior to remediation.
Review third-party model provider access logs to determine whether system prompts containing hashed owner IDs were observable to unauthorized parties during the exposure window.
Audit OpenClaw gateway authentication logs for anomalous client authentication events in the period prior to patch deployment.
Implement network-level controls limiting which systems can observe prompt traffic to external LLM providers.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0069.002 - System Prompt AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security in development and deployment

NIST AI RMF

GOVERN 6.1 - Organizational risk policies for AI systems

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM07:2025 - System Prompt Leakage

Frequently Asked Questions

What is CVE-2026-32897?

OpenClaw prior to 2026.2.22 reuses the gateway authentication token as the fallback HMAC secret for owner-ID obfuscation in system prompts, meaning any party with visibility into prompts forwarded to third-party LLM providers can cryptanalytically recover the master gateway credential. Although the CVSS score is 3.7 (Low), EPSS places this in the top 83rd percentile for exploitation likelihood — a rate that outpaces most medium-severity CVEs — and a successfully derived token grants full gateway authentication, not merely disclosure of obfuscated owner IDs. No public exploit exists and only 4 tracked downstream dependents constrain the immediate blast radius, but any OpenClaw deployment with commands.ownerDisplay=hash and an unset ownerDisplaySecret is silently misconfigured by default. Upgrade to 2026.2.22 immediately; as an interim workaround, explicitly set commands.ownerDisplaySecret to a cryptographically independent value, rotate gateway.auth.token, and audit gateway authentication logs for anomalous access patterns.

Is CVE-2026-32897 actively exploited?

No confirmed active exploitation of CVE-2026-32897 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32897?

1. Upgrade OpenClaw to 2026.2.22 or later — the patch introduces separate key material for the owner-ID hash function, eliminating the dual-use of the gateway token. 2. If immediate patching is not feasible, explicitly set commands.ownerDisplaySecret to a cryptographically random string independent of gateway.auth.token. 3. Rotate gateway.auth.token after patching to invalidate any credentials that may have been derived prior to remediation. 4. Review third-party model provider access logs to determine whether system prompts containing hashed owner IDs were observable to unauthorized parties during the exposure window. 5. Audit OpenClaw gateway authentication logs for anomalous client authentication events in the period prior to patch deployment. 6. Implement network-level controls limiting which systems can observe prompt traffic to external LLM providers.

What systems are affected by CVE-2026-32897?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM API gateways, multi-provider LLM routing, system prompt pipelines.

What is the CVSS score for CVE-2026-32897?

CVE-2026-32897 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM API gatewaysmulti-provider LLM routingsystem prompt pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0069.002 System Prompt

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM02:2025, LLM07:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.

Exploitation Scenario

An adversary with access to a third-party LLM provider's prompt logs — through a provider-side account, a compromised shared logging stack, or an insider — identifies system prompts originating from an OpenClaw gateway instance. By collecting multiple prompts containing hashed owner IDs (each using gateway.auth.token as the static HMAC secret by default), the attacker performs hash-preimage analysis to recover the token. With the gateway credential in hand, the attacker authenticates directly to the OpenClaw API, bypassing user-level controls and gaining access to all configured model backends, API proxy routes, and secrets stored in the gateway's agent tool integrations — all without triggering standard user authentication flows.