CVE-2026-32899: OpenClaw sender-policy bypass

CISO Take

OpenClaw fails to apply sender-policy checks to reaction_* and pin_* event types, allowing any low-privileged authenticated user—including those explicitly blocked by DM policies or channel allowlists—to inject events directly into the AI agent's system-event context. While CVSS sits at 4.3 (Medium), EPSS places this at the 90th percentile for exploitation likelihood, and OpenClaw's ecosystem is already documented for malicious third-party skill abuse (AIID #1368), making unauthorized context injection a credible pivot toward agent manipulation. No public exploit exists and the CVE is absent from CISA KEV, but the low-privilege, no-user-interaction attack surface means any authenticated user in a multi-tenant deployment is a potential threat actor. Upgrade to OpenClaw 2026.2.25 or later immediately and audit system-event logs for reaction_* and pin_* events originating from policy-restricted senders.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Medium severity by CVSS (4.3) but contextually elevated in AI agent deployments. CWE-863 (Incorrect Authorization) on event routing means the integrity control protecting agent context is bypassable with only low privileges over the network. The 90th EPSS percentile indicates broader-than-typical exploitation interest relative to peers at this severity level. With 396 prior CVEs in the same package, the OpenClaw attack surface is well-characterized by threat actors. Risk is primarily to integrity—unauthorized events can steer agent behavior—rather than confidentiality or availability, but in agentic workflows that integrity impact can cascade into unauthorized tool invocations or workflow state manipulation.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw with a low-privilege account that is explicitly restricted from a target channel via DM policy or user allowlist.

AML.T0012

Policy Bypass

Attacker sends crafted reaction_* or pin_* events targeting the restricted channel; OpenClaw skips sender-policy validation for these non-message event types and accepts them.

AML.T0049

Context Injection

Unauthorized events are appended to the AI agent's system-event context, appearing as legitimate signals indistinguishable from authorized participant activity.

AML.T0080

Agent Manipulation

The AI agent acts on injected events, potentially triggering unintended tool calls, workflow steps, or behavioral changes that the policy-restricted sender should never have been able to initiate.

AML.T0053

Initial Access

Attacker authenticates to OpenClaw with a low-privilege account that is explicitly restricted from a target channel via DM policy or user allowlist.

AML.T0012

Policy Bypass

Attacker sends crafted reaction_* or pin_* events targeting the restricted channel; OpenClaw skips sender-policy validation for these non-message event types and accepts them.

AML.T0049

Context Injection

Unauthorized events are appended to the AI agent's system-event context, appearing as legitimate signals indistinguishable from authorized participant activity.

AML.T0080

Agent Manipulation

The AI agent acts on injected events, potentially triggering unintended tool calls, workflow steps, or behavioral changes that the policy-restricted sender should never have been able to initiate.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.2.25 or later, which applies consistent sender-policy validation to all event types including reaction_* and pin_*.
Until patched, restrict OpenClaw deployments to trusted, homogeneous user pools where allowlist enforcement is not the primary isolation boundary.
Audit system-event logs for reaction_* and pin_* events emitted by senders configured as restricted in DM policies or channel allowlists.
Review and patch all downstream dependents that embed OpenClaw as a library.
Enable event-level audit logging in OpenClaw to establish a detection baseline for anomalous event injection patterns.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Prompt Injection Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

GOVERN 1.2 - Organizational risk tolerance for AI

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32899?

OpenClaw fails to apply sender-policy checks to reaction_* and pin_* event types, allowing any low-privileged authenticated user—including those explicitly blocked by DM policies or channel allowlists—to inject events directly into the AI agent's system-event context. While CVSS sits at 4.3 (Medium), EPSS places this at the 90th percentile for exploitation likelihood, and OpenClaw's ecosystem is already documented for malicious third-party skill abuse (AIID #1368), making unauthorized context injection a credible pivot toward agent manipulation. No public exploit exists and the CVE is absent from CISA KEV, but the low-privilege, no-user-interaction attack surface means any authenticated user in a multi-tenant deployment is a potential threat actor. Upgrade to OpenClaw 2026.2.25 or later immediately and audit system-event logs for reaction_* and pin_* events originating from policy-restricted senders.

Is CVE-2026-32899 actively exploited?

No confirmed active exploitation of CVE-2026-32899 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32899?

1. Upgrade OpenClaw to version 2026.2.25 or later, which applies consistent sender-policy validation to all event types including reaction_* and pin_*. 2. Until patched, restrict OpenClaw deployments to trusted, homogeneous user pools where allowlist enforcement is not the primary isolation boundary. 3. Audit system-event logs for reaction_* and pin_* events emitted by senders configured as restricted in DM policies or channel allowlists. 4. Review and patch all downstream dependents that embed OpenClaw as a library. 5. Enable event-level audit logging in OpenClaw to establish a detection baseline for anomalous event injection patterns.

What systems are affected by CVE-2026-32899?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, event-driven AI pipelines.

What is the CVSS score for CVE-2026-32899?

CVE-2026-32899 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationevent-driven AI pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.

Exploitation Scenario

An attacker with a low-privilege account blocked from a target channel via the allowlist sends crafted reaction_* or pin_* events directly against the OpenClaw API. Because pre-2026.2.25 code skips sender validation for these non-message event types, the events pass through and are appended to the AI agent's system-event context. The agent, treating these as legitimate signals from authorized participants, may trigger downstream workflow steps, summarize or act on pinned content, or update internal state in ways the channel administrators did not sanction. In a multi-tenant enterprise deployment where the agent coordinates sensitive workflows, this provides a low-effort path to indirect influence over agent behavior without controlling any message content directly—essentially a policy-invisible prompt injection via event injection.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.