CVE-2026-32916: OpenClaw auth bypass enables

CISO Take

CVE-2026-32916 is a critical authorization bypass in OpenClaw's plugin subagent routing layer where plugin-owned routes execute through a synthetic operator client with full administrative scopes, allowing any unauthenticated remote attacker to invoke privileged gateway methods including session deletion and arbitrary agent execution. At CVSS 9.4 with zero authentication, privilege, or user interaction required, this is a worst-case exposure profile for an AI agent framework used in enterprise environments. The EPSS score places this in the top 64th percentile for likely exploitation, and OpenClaw's plugin ecosystem has already been the subject of a documented malicious skills incident (AIID #1368) demonstrating real attacker interest in this attack surface. Immediate action: patch to OpenClaw 2026.3.11 or later; if patching is not immediately possible, block unauthenticated access to all plugin-owned routes at the gateway or WAF layer and audit logs for unexpected runtime.subagent invocations.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Critical risk. The vulnerability allows remote code-equivalent impact with no prerequisites — no credentials, no special network position, no user interaction required. An attacker can execute agents in the victim's OpenClaw environment, effectively gaining full control over the agent runtime. The combination of unauthenticated network access and broad administrative scope means a single exploit attempt can compromise an entire deployment. Although CISA KEV status is not confirmed and no public exploit exists yet, the trivial exploitation complexity and critical impact make this a high-priority patch target with no acceptable delay.

How does the attack unfold?

Discovery

Attacker identifies an internet-exposed OpenClaw deployment and enumerates plugin-owned routes through active scanning or public plugin documentation.

AML.T0006

Initial Access

Attacker sends a crafted unauthenticated HTTP request to a plugin-owned subagent route; OpenClaw routes this through a synthetic operator client with broad administrative scopes without validating the caller's identity.

AML.T0049

Privilege Escalation

Via the synthetic operator context, attacker invokes runtime.subagent gateway methods — authenticated only by the plugin's synthetic admin token — gaining full privileged control over the agent runtime.

AML.T0053

Impact

Attacker deletes active user sessions to cause disruption, deploys arbitrary agents under administrative privileges to exfiltrate data, or installs a persistent malicious plugin for ongoing access.

AML.T0103

Discovery

Attacker identifies an internet-exposed OpenClaw deployment and enumerates plugin-owned routes through active scanning or public plugin documentation.

AML.T0006

Initial Access

Attacker sends a crafted unauthenticated HTTP request to a plugin-owned subagent route; OpenClaw routes this through a synthetic operator client with broad administrative scopes without validating the caller's identity.

AML.T0049

Privilege Escalation

Via the synthetic operator context, attacker invokes runtime.subagent gateway methods — authenticated only by the plugin's synthetic admin token — gaining full privileged control over the agent runtime.

AML.T0053

Impact

Attacker deletes active user sessions to cause disruption, deploys arbitrary agents under administrative privileges to exfiltrate data, or installs a persistent malicious plugin for ongoing access.

AML.T0103

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.4 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A Low

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to version 2026.3.11 or later.
If immediate patching is not possible, implement WAF or gateway-level rules blocking unauthenticated requests to all plugin-owned subagent routes.
Audit recent logs for unexpected runtime.subagent method invocations, especially originating from unauthenticated or external sources.
Review all installed third-party plugins and disable any not strictly required to reduce attack surface.
Monitor for anomalous agent execution patterns — agents firing without user-initiated sessions is a strong indicator of exploitation.
If your environment uses third-party OpenClaw skills or plugins, cross-reference with AIID #1368 indicators and audit installed plugins independently of this CVE patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0103 - Deploy AI Agent AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1 - Actions to address AI risks and opportunities A.9.4 - Security of AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to AI risk

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32916?

CVE-2026-32916 is a critical authorization bypass in OpenClaw's plugin subagent routing layer where plugin-owned routes execute through a synthetic operator client with full administrative scopes, allowing any unauthenticated remote attacker to invoke privileged gateway methods including session deletion and arbitrary agent execution. At CVSS 9.4 with zero authentication, privilege, or user interaction required, this is a worst-case exposure profile for an AI agent framework used in enterprise environments. The EPSS score places this in the top 64th percentile for likely exploitation, and OpenClaw's plugin ecosystem has already been the subject of a documented malicious skills incident (AIID #1368) demonstrating real attacker interest in this attack surface. Immediate action: patch to OpenClaw 2026.3.11 or later; if patching is not immediately possible, block unauthenticated access to all plugin-owned routes at the gateway or WAF layer and audit logs for unexpected runtime.subagent invocations.

Is CVE-2026-32916 actively exploited?

No confirmed active exploitation of CVE-2026-32916 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32916?

1. Patch immediately: upgrade OpenClaw to version 2026.3.11 or later. 2. If immediate patching is not possible, implement WAF or gateway-level rules blocking unauthenticated requests to all plugin-owned subagent routes. 3. Audit recent logs for unexpected runtime.subagent method invocations, especially originating from unauthenticated or external sources. 4. Review all installed third-party plugins and disable any not strictly required to reduce attack surface. 5. Monitor for anomalous agent execution patterns — agents firing without user-initiated sessions is a strong indicator of exploitation. 6. If your environment uses third-party OpenClaw skills or plugins, cross-reference with AIID #1368 indicators and audit installed plugins independently of this CVE patch.

What systems are affected by CVE-2026-32916?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, plugin-based AI workflows, enterprise AI assistant deployments.

What is the CVSS score for CVE-2026-32916?

CVE-2026-32916 has a CVSS v3.1 base score of 9.4 (CRITICAL). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration platformsplugin-based AI workflowsenterprise AI assistant deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0103 Deploy AI Agent

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 6.1, A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.

Exploitation Scenario

An attacker scans for internet-exposed OpenClaw deployments and identifies a plugin-owned HTTP route (e.g., a publicly documented webhook or API endpoint of an installed plugin). By sending a crafted, unauthenticated POST request to that route, the attacker triggers the plugin subagent router, which internally creates a synthetic operator client with broad administrative scopes. Through this context, the attacker calls runtime.subagent methods to enumerate active sessions and delete them to cause disruption, then deploys a new agent with elevated privileges to exfiltrate sensitive data processed by the platform — or installs a persistent malicious plugin to maintain access after patching, mirroring the AIID #1368 stealer campaign pattern.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.