CVE-2026-32919: OpenClaw auth bypass enables

CISO Take

OpenClaw before 2026.3.11 contains a privilege escalation flaw (CWE-863) where any caller holding operator.write scope can invoke admin-only /new and /reset slash commands to terminate arbitrary conversation sessions without requiring operator.admin privileges. Although the attack vector is local and the absolute EPSS probability is low at 0.096%, this CVE sits in the 99th percentile of all CVEs by exploitation likelihood, and OpenClaw's track record of 396 tracked CVEs—alongside documented third-party skill abuse in AIID #1368—signals its ecosystem is under sustained adversarial pressure. The high availability impact (CVSS A:H) means that in production agent deployments, unauthorized session resets can disrupt ongoing workflows, compliance checks, or incident-response automations with no admin credentials required. Upgrade to OpenClaw 2026.3.11 immediately and audit operator.write scope grants; monitor for anomalous /new and /reset slash commands issued by non-admin callers in agent request logs.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium risk overall, with elevated concern in AI agent production deployments. The CVSS score of 6.1 (Medium) reflects a local attack vector requiring low privileges, but in enterprise AI agent environments operator.write scope is routinely distributed to service accounts, CI/CD pipelines, and developer integrations—making the realistic attacker pool larger than a strict local interpretation implies. The 99th-percentile EPSS ranking indicates meaningful exploitation interest relative to the broader CVE population, despite the low absolute probability (0.096%). No public exploit code, CISA KEV listing, or Nuclei scanner template currently exists. The primary risk is targeted availability disruption: adversaries with write-scope access can silently destroy in-progress AI agent session state, with no confidentiality impact but high availability damage to dependent workflows.

How does the attack unfold?

Initial Access via Valid Credentials

Attacker obtains or already holds a valid operator.write API token through legitimate access, insider position, or a compromised service account with write-scope permissions.

AML.T0012

Exploitation of Authorization Bypass

Attacker crafts an agent API request embedding a /new or /reset slash command; the vulnerable OpenClaw handler processes it without verifying operator.admin privilege due to CWE-863.

AML.T0053

Session State Destruction

The targeted conversation session is reset, destroying all in-progress agent context, tool states, and workflow history without alerting the session owner or triggering admin-level audit events.

AML.T0080.001

Initial Access via Valid Credentials

Attacker obtains or already holds a valid operator.write API token through legitimate access, insider position, or a compromised service account with write-scope permissions.

AML.T0012

Exploitation of Authorization Bypass

Attacker crafts an agent API request embedding a /new or /reset slash command; the vulnerable OpenClaw handler processes it without verifying operator.admin privilege due to CWE-863.

AML.T0053

Session State Destruction

The targeted conversation session is reset, destroying all in-progress agent context, tool states, and workflow history without alerting the session owner or triggering admin-level audit events.

AML.T0080.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A High

What should I do?

5 steps

Upgrade to OpenClaw 2026.3.11 or later — this is the patched version per vendor advisory GHSA-jf6w-m8jw-jfxc.
Until patched, audit all operator.write scope grants; revoke those not strictly necessary and apply least-privilege to service accounts and integrations.
Implement monitoring or API gateway rules to detect /new and /reset slash commands in agent request payloads from write-scoped (non-admin) callers — legitimate write-scope operators should not be issuing these commands.
Review historical audit logs for anomalous session reset commands issued by non-admin accounts.
In multi-tenant environments, evaluate session isolation architecture to determine cross-tenant blast radius. Reference vendor advisory GHSA-jf6w-m8jw-jfxc and VulnCheck advisory for full technical details.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0080.001 - Thread AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art.9 - Risk management system

ISO 42001

A.6.1.3 - Access control for AI systems

NIST AI RMF

GOVERN 1.1 - Policies and processes for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32919?

OpenClaw before 2026.3.11 contains a privilege escalation flaw (CWE-863) where any caller holding operator.write scope can invoke admin-only /new and /reset slash commands to terminate arbitrary conversation sessions without requiring operator.admin privileges. Although the attack vector is local and the absolute EPSS probability is low at 0.096%, this CVE sits in the 99th percentile of all CVEs by exploitation likelihood, and OpenClaw's track record of 396 tracked CVEs—alongside documented third-party skill abuse in AIID #1368—signals its ecosystem is under sustained adversarial pressure. The high availability impact (CVSS A:H) means that in production agent deployments, unauthorized session resets can disrupt ongoing workflows, compliance checks, or incident-response automations with no admin credentials required. Upgrade to OpenClaw 2026.3.11 immediately and audit operator.write scope grants; monitor for anomalous /new and /reset slash commands issued by non-admin callers in agent request logs.

Is CVE-2026-32919 actively exploited?

No confirmed active exploitation of CVE-2026-32919 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32919?

1. Upgrade to OpenClaw 2026.3.11 or later — this is the patched version per vendor advisory GHSA-jf6w-m8jw-jfxc. 2. Until patched, audit all operator.write scope grants; revoke those not strictly necessary and apply least-privilege to service accounts and integrations. 3. Implement monitoring or API gateway rules to detect /new and /reset slash commands in agent request payloads from write-scoped (non-admin) callers — legitimate write-scope operators should not be issuing these commands. 4. Review historical audit logs for anomalous session reset commands issued by non-admin accounts. 5. In multi-tenant environments, evaluate session isolation architecture to determine cross-tenant blast radius. Reference vendor advisory GHSA-jf6w-m8jw-jfxc and VulnCheck advisory for full technical details.

What systems are affected by CVE-2026-32919?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, conversational AI platforms, AI-augmented security operations.

What is the CVSS score for CVE-2026-32919?

CVE-2026-32919 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsconversational AI platformsAI-augmented security operations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0080.001 Thread

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art.9

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privileges.

Exploitation Scenario

An attacker holding a legitimate operator.write API token — obtained via insider access, a compromised developer workstation, or a breached CI/CD service account — identifies an active OpenClaw agent session belonging to a security analyst conducting an ongoing threat investigation. Using the standard OpenClaw agent API, the attacker embeds a /reset slash command in a crafted agent request. Because vulnerable versions fail to enforce operator.admin privilege at the session reset handler, the request succeeds. The targeted analyst's session is silently wiped, destroying accumulated investigation context and forcing a workflow restart. In a high-stakes scenario such as active incident response, repeated targeted resets could materially impede the security team's ability to contain a breach, while the attacker's activity blends into normal write-scope API traffic.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.