CVE-2026-32972: OpenClaw auth bypass enables

CISO Take

OpenClaw before 2026.3.11 contains a CWE-863 authorization boundary failure allowing any authenticated user holding only operator.write privileges to reach admin-only browser profile management routes via browser.request — no admin credentials required. The critical consequence is persistence: the attacker can write an attacker-controlled remote Chrome DevTools Protocol (CDP) endpoint to disk, giving near-full browser control — JavaScript execution, session token harvesting, network interception — across every agent restart until manually remediated. EPSS places this vulnerability in the top 80th percentile of exploitation likelihood, and AIID incident #1368 confirms active adversary interest in OpenClaw's ecosystem for credential theft, validating this as a live target. Upgrade to 2026.3.11 immediately, audit all browser profile configurations for unauthorized CDP entries, and treat operator.write as a sensitive privileged role pending access review.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk in any OpenClaw deployment exposed to multi-tenant, contractor, or untrusted operator access. The low-privilege requirement (operator.write) and zero user-interaction exploit path make this accessible to any authenticated internal or external attacker without social engineering. The persistence mechanism — writing a malicious CDP endpoint to disk — elevates this beyond a one-time exploit into a durable implant that survives process restarts. The package's history of 396 CVEs signals systemic authorization weaknesses across the codebase. EPSS top-80 percentile indicates meaningful exploitation probability even without a public proof-of-concept.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw using a compromised or insider operator.write account — the minimum privilege level required to invoke browser.request.

AML.T0012

Authorization Bypass

Attacker sends browser.request calls targeting admin-only browser profile management routes; the missing authorization check (CWE-863) grants admin-tier API access without operator.admin credentials.

AML.T0049

Persistence

Attacker creates or modifies a browser profile setting the remote CDP endpoint to an attacker-controlled server, writing the configuration to disk where it survives restarts.

AML.T0081

Impact

When OpenClaw's browser agent next uses the poisoned profile, it connects to the attacker's CDP server, granting real-time full browser control: session token theft, credential harvesting, traffic interception, and command injection against every site the agent accesses.

AML.T0053

Initial Access

Attacker authenticates to OpenClaw using a compromised or insider operator.write account — the minimum privilege level required to invoke browser.request.

AML.T0012

Authorization Bypass

Attacker sends browser.request calls targeting admin-only browser profile management routes; the missing authorization check (CWE-863) grants admin-tier API access without operator.admin credentials.

AML.T0049

Persistence

Attacker creates or modifies a browser profile setting the remote CDP endpoint to an attacker-controlled server, writing the configuration to disk where it survives restarts.

AML.T0081

Impact

When OpenClaw's browser agent next uses the poisoned profile, it connects to the attacker's CDP server, granting real-time full browser control: session token theft, credential harvesting, traffic interception, and command injection against every site the agent accesses.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.11 or later immediately — this is the only full remediation.
Audit: Inspect all stored browser profile configurations (both database-persisted and filesystem-stored) for CDP remote endpoint entries not provisioned by your ops team; any unexpected remoteDebuggingUrl or cdpEndpoint value is a compromise indicator.
Access Control: Restrict operator.write to the minimum necessary personnel and audit all current grantees; treat it as an admin-tier role until the authorization model is reviewed post-patch.
Detection: Alert on browser.request calls targeting /browser/profiles or equivalent admin route prefixes from sessions without operator.admin claims in application logs.
Network: Block outbound TCP port 9222 (default CDP) from production agent hosts to untrusted external destinations as a backstop against active C2 channels.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - Information access restriction

NIST AI RMF

GOVERN 1.2 - Accountability and roles

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32972?

OpenClaw before 2026.3.11 contains a CWE-863 authorization boundary failure allowing any authenticated user holding only operator.write privileges to reach admin-only browser profile management routes via browser.request — no admin credentials required. The critical consequence is persistence: the attacker can write an attacker-controlled remote Chrome DevTools Protocol (CDP) endpoint to disk, giving near-full browser control — JavaScript execution, session token harvesting, network interception — across every agent restart until manually remediated. EPSS places this vulnerability in the top 80th percentile of exploitation likelihood, and AIID incident #1368 confirms active adversary interest in OpenClaw's ecosystem for credential theft, validating this as a live target. Upgrade to 2026.3.11 immediately, audit all browser profile configurations for unauthorized CDP entries, and treat operator.write as a sensitive privileged role pending access review.

Is CVE-2026-32972 actively exploited?

No confirmed active exploitation of CVE-2026-32972 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32972?

1. Patch: Upgrade OpenClaw to version 2026.3.11 or later immediately — this is the only full remediation. 2. Audit: Inspect all stored browser profile configurations (both database-persisted and filesystem-stored) for CDP remote endpoint entries not provisioned by your ops team; any unexpected remoteDebuggingUrl or cdpEndpoint value is a compromise indicator. 3. Access Control: Restrict operator.write to the minimum necessary personnel and audit all current grantees; treat it as an admin-tier role until the authorization model is reviewed post-patch. 4. Detection: Alert on browser.request calls targeting /browser/profiles or equivalent admin route prefixes from sessions without operator.admin claims in application logs. 5. Network: Block outbound TCP port 9222 (default CDP) from production agent hosts to untrusted external destinations as a backstop against active C2 channels.

What systems are affected by CVE-2026-32972?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Browser automation pipelines, Agentic web research systems, RPA-AI integrations.

What is the CVSS score for CVE-2026-32972?

CVE-2026-32972 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksBrowser automation pipelinesAgentic web research systemsRPA-AI integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist attacker-controlled remote CDP endpoints to disk without holding operator.admin privileges.

Exploitation Scenario

An insider threat or attacker who has compromised a vendor account holding operator.write access authenticates to the OpenClaw management API. They craft browser.request calls targeting the admin-only /browser/profiles endpoint — a route normally restricted to operator.admin — and create a new browser profile with the remote CDP URL pointing to an attacker-controlled server at a cloud VPS. OpenClaw persists this configuration to disk without validation. The next time the agent spawns a browser session using this profile, it establishes a bidirectional CDP connection to the attacker's server: the attacker observes every page the agent visits, extracts authentication cookies and API tokens from target SaaS platforms, issues CDP commands to exfiltrate files or redirect the agent's actions, and maintains this access silently across restarts until the profile is manually removed.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.