CVE-2026-32924: OpenClaw auth bypass

CISO Take

CVE-2026-32924 is a critical (CVSS 9.8) authorization bypass in OpenClaw, the AI agent framework for Feishu/Lark, where reaction events with a missing chat_type field are silently treated as private one-on-one conversations rather than group chats — effectively stripping the groupAllowFrom access controls and the requireMention gate that are the primary barriers against unauthorized agent interaction in group deployments. Any network attacker can craft a Feishu reaction event with the field omitted, with no credentials, no privileges, and no user interaction required; EPSS places this in the top 78th percentile for near-term exploitation probability, and the incident history of OpenClaw — including AIID #1368 documenting credential-stealing malicious skills distributed through its ecosystem — confirms this framework is already a high-value threat actor target. Patch to OpenClaw 2026.3.12 immediately, or as a temporary workaround disable reaction-triggered interactions in group channels until the upgrade is applied.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Critical risk for any organization running OpenClaw connected to a Feishu workspace in a group context. The CVSS 9.8 profile reflects worst-case exploitability: network-accessible, low complexity, no privileges, no user interaction, full confidentiality/integrity/availability impact. The bypass is architectural — a missing field in an event payload overrides access control logic entirely — making it trivially reproducible without any AI or security expertise. EPSS at 0.00309 (top 78th percentile) indicates meaningful near-term exploitation probability, though absence from CISA KEV and no confirmed public exploit code slightly tempers urgency below actively-exploited severity. The 396 prior CVEs in the same package signal a sustained pattern of insufficient security rigor in the codebase that elevates overall risk posture for all OpenClaw deployments.

How does the attack unfold?

Initial Access

Attacker with minimal Feishu workspace presence (external collaborator or compromised low-privilege account) identifies a group chat with a deployed OpenClaw bot that has groupAllowFrom and requireMention protections configured.

AML.T0049

Authorization Bypass

Attacker crafts a Feishu reaction event with the chat_type field omitted; OpenClaw misclassifies it as a p2p conversation and silently bypasses all group-context access controls.

AML.T0049

Unauthorized Agent Control

With access controls bypassed, attacker issues arbitrary commands to the AI agent, invoking its connected tools and workflows as if they were an authorized private user.

AML.T0053

Impact

Attacker exfiltrates data, executes unauthorized actions via agent-connected tools, or injects malicious instructions into ongoing agent workflows depending on the integrations and credentials available to the OpenClaw instance.

AML.T0086

Initial Access

Attacker with minimal Feishu workspace presence (external collaborator or compromised low-privilege account) identifies a group chat with a deployed OpenClaw bot that has groupAllowFrom and requireMention protections configured.

AML.T0049

Authorization Bypass

Attacker crafts a Feishu reaction event with the chat_type field omitted; OpenClaw misclassifies it as a p2p conversation and silently bypasses all group-context access controls.

AML.T0049

Unauthorized Agent Control

With access controls bypassed, attacker issues arbitrary commands to the AI agent, invoking its connected tools and workflows as if they were an authorized private user.

AML.T0053

Impact

Attacker exfiltrates data, executes unauthorized actions via agent-connected tools, or injects malicious instructions into ongoing agent workflows depending on the integrations and credentials available to the OpenClaw instance.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.12 or later — this is the only complete remediation.
Workaround (if immediate patching is not possible): Disable reaction-event triggers in OpenClaw group configurations, or restrict the Feishu bot to private channels only until patching is complete.
Detection: Review OpenClaw access logs for agent responses triggered by users not present in the groupAllowFrom allowlist, or responses in group channels that were not preceded by an explicit @mention. Anomalous agent activity from unexpected Feishu user IDs should be treated as potential exploitation.
Audit: Enumerate all OpenClaw deployments connected to Feishu group chats and verify version against 2026.3.12.
Defense-in-depth: Apply least-privilege to agent tool permissions regardless of patch status — ensure agents cannot access sensitive systems beyond their declared function scope.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - Access control for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32924?

CVE-2026-32924 is a critical (CVSS 9.8) authorization bypass in OpenClaw, the AI agent framework for Feishu/Lark, where reaction events with a missing chat_type field are silently treated as private one-on-one conversations rather than group chats — effectively stripping the groupAllowFrom access controls and the requireMention gate that are the primary barriers against unauthorized agent interaction in group deployments. Any network attacker can craft a Feishu reaction event with the field omitted, with no credentials, no privileges, and no user interaction required; EPSS places this in the top 78th percentile for near-term exploitation probability, and the incident history of OpenClaw — including AIID #1368 documenting credential-stealing malicious skills distributed through its ecosystem — confirms this framework is already a high-value threat actor target. Patch to OpenClaw 2026.3.12 immediately, or as a temporary workaround disable reaction-triggered interactions in group channels until the upgrade is applied.

Is CVE-2026-32924 actively exploited?

No confirmed active exploitation of CVE-2026-32924 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32924?

1. Patch: Upgrade OpenClaw to version 2026.3.12 or later — this is the only complete remediation. 2. Workaround (if immediate patching is not possible): Disable reaction-event triggers in OpenClaw group configurations, or restrict the Feishu bot to private channels only until patching is complete. 3. Detection: Review OpenClaw access logs for agent responses triggered by users not present in the groupAllowFrom allowlist, or responses in group channels that were not preceded by an explicit @mention. Anomalous agent activity from unexpected Feishu user IDs should be treated as potential exploitation. 4. Audit: Enumerate all OpenClaw deployments connected to Feishu group chats and verify version against 2026.3.12. 5. Defense-in-depth: Apply least-privilege to agent tool permissions regardless of patch status — ensure agents cannot access sensitive systems beyond their declared function scope.

What systems are affected by CVE-2026-32924?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Enterprise messaging-integrated agents, Feishu/Lark-connected AI workflows, Agent orchestration pipelines.

What is the CVSS score for CVE-2026-32924?

CVE-2026-32924 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksEnterprise messaging-integrated agentsFeishu/Lark-connected AI workflowsAgent orchestration pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.

Exploitation Scenario

A threat actor targeting an enterprise using Feishu and OpenClaw identifies that a group workspace has an OpenClaw bot configured with groupAllowFrom restricted to a specific set of senior employees and requireMention enabled to prevent unsolicited agent responses. The attacker, present in the Feishu workspace as a low-privilege external collaborator or via a compromised account, sends a crafted reaction event to the group chat with the chat_type field deliberately omitted from the event payload. OpenClaw misclassifies the event as a p2p interaction, bypasses the group access controls in their entirety, and processes the command as if issued by an authorized private user. The attacker then instructs the agent to retrieve sensitive documents, call internal APIs with the agent's credentials, or relay confidential information — all without triggering mention-based alerting or appearing in group message history.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.