CVE-2026-32975: OpenClaw auth bypass

CISO Take

OpenClaw before 2026.3.12 allows any network-accessible attacker to bypass its Zalouser allowlist authorization by creating a messaging group whose display name matches a legitimately allowlisted group — the vulnerability stems from comparing mutable display names instead of stable group identifiers, granting attackers the ability to route arbitrary messages to deployed AI agents without authorization. With a CVSS score of 9.8, zero privileges required, and no user interaction needed, this is a zero-barrier remote exploit; EPSS places it in the top 75th percentile for exploitation probability, and the same package carries 396 other CVEs indicating systemic security quality concerns in this codebase. Organizations running OpenClaw with Zalouser allowlist mode should treat this as an emergency: upgrade immediately to 2026.3.12+, audit agent message routing logs for anomalous group sources, and verify post-patch that authorization relies on stable identifiers rather than display names.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Critical risk for any organization using OpenClaw with Zalouser allowlist mode enabled. The CVSS 9.8 reflects maximum severity across all key dimensions — network access vector, low complexity, and no privileges required — making this trivially exploitable by any attacker who can reach the OpenClaw endpoint. While EPSS at 0.00335 indicates low observed exploitation to date, the trivial exploit path and critical score make escalation likely once awareness spreads. The 396 other CVEs tracked against this same package signal a codebase with recurring security quality issues, increasing the plausibility of chained attacks. Deployment in enterprise AI agent pipelines, where agents often hold privileged access to internal tools and data, significantly amplifies potential business impact beyond what the CVE score alone conveys.

How does the attack unfold?

Reconnaissance

Attacker identifies a target OpenClaw deployment using Zalouser allowlist mode and enumerates allowlisted group display names via documentation review, public OSINT, or probe requests to infer naming conventions.

AML.T0084.002

Identity Spoofing

Attacker creates a new messaging group with a display name byte-for-byte identical to a known allowlisted group, exploiting the fact that OpenClaw's Zalouser mode compares mutable display names rather than stable immutable group identifiers.

AML.T0074

Authorization Bypass

Messages from the spoofed group pass Zalouser allowlist validation because OpenClaw's name-matching logic cannot distinguish the forged group from the legitimate one, granting the attacker full unauthorized agent channel access.

AML.T0049

Agent Exploitation

Attacker routes malicious instructions through the now-authorized channel to invoke agent tools, exfiltrate data accessible to the agent, inject adversarial prompts, or pivot into connected enterprise systems.

AML.T0053

Reconnaissance

Attacker identifies a target OpenClaw deployment using Zalouser allowlist mode and enumerates allowlisted group display names via documentation review, public OSINT, or probe requests to infer naming conventions.

AML.T0084.002

Identity Spoofing

Attacker creates a new messaging group with a display name byte-for-byte identical to a known allowlisted group, exploiting the fact that OpenClaw's Zalouser mode compares mutable display names rather than stable immutable group identifiers.

AML.T0074

Authorization Bypass

Messages from the spoofed group pass Zalouser allowlist validation because OpenClaw's name-matching logic cannot distinguish the forged group from the legitimate one, granting the attacker full unauthorized agent channel access.

AML.T0049

Agent Exploitation

Attacker routes malicious instructions through the now-authorized channel to invoke agent tools, exfiltrate data accessible to the agent, inject adversarial prompts, or pivot into connected enterprise systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade OpenClaw to version 2026.3.12 or later immediately — this is the only complete remediation.
If immediate patching is not possible, disable Zalouser allowlist mode or restrict OpenClaw network access to explicitly trusted internal segments only via firewall rules.
Post-upgrade, audit all Zalouser allowlist configurations to confirm authorization operates on stable, immutable group identifiers and not display names.
Review agent message routing logs for the past 90 days for messages originating from groups not in your verified allowlist — specifically look for groups created recently with names matching known allowlisted groups.
Implement defense-in-depth network controls limiting which hosts can reach the OpenClaw agent endpoint, independent of application-layer authorization.
Treat any AI agent connected to OpenClaw as potentially compromised if the deployment predates the patch without the above mitigations in place.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0084.002 - Activation Triggers

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operation

NIST AI RMF

MEASURE 2.6 - Risk and benefit evaluation for AI system operation

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32975?

OpenClaw before 2026.3.12 allows any network-accessible attacker to bypass its Zalouser allowlist authorization by creating a messaging group whose display name matches a legitimately allowlisted group — the vulnerability stems from comparing mutable display names instead of stable group identifiers, granting attackers the ability to route arbitrary messages to deployed AI agents without authorization. With a CVSS score of 9.8, zero privileges required, and no user interaction needed, this is a zero-barrier remote exploit; EPSS places it in the top 75th percentile for exploitation probability, and the same package carries 396 other CVEs indicating systemic security quality concerns in this codebase. Organizations running OpenClaw with Zalouser allowlist mode should treat this as an emergency: upgrade immediately to 2026.3.12+, audit agent message routing logs for anomalous group sources, and verify post-patch that authorization relies on stable identifiers rather than display names.

Is CVE-2026-32975 actively exploited?

No confirmed active exploitation of CVE-2026-32975 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32975?

1. Upgrade OpenClaw to version 2026.3.12 or later immediately — this is the only complete remediation. 2. If immediate patching is not possible, disable Zalouser allowlist mode or restrict OpenClaw network access to explicitly trusted internal segments only via firewall rules. 3. Post-upgrade, audit all Zalouser allowlist configurations to confirm authorization operates on stable, immutable group identifiers and not display names. 4. Review agent message routing logs for the past 90 days for messages originating from groups not in your verified allowlist — specifically look for groups created recently with names matching known allowlisted groups. 5. Implement defense-in-depth network controls limiting which hosts can reach the OpenClaw agent endpoint, independent of application-layer authorization. 6. Treat any AI agent connected to OpenClaw as potentially compromised if the deployment predates the patch without the above mitigations in place.

What systems are affected by CVE-2026-32975?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, messaging-integrated agents, enterprise AI automation pipelines, multi-channel AI agent deployments.

What is the CVSS score for CVE-2026-32975?

CVE-2026-32975 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmessaging-integrated agentsenterprise AI automation pipelinesmulti-channel AI agent deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0084.002 Activation Triggers

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.

Exploitation Scenario

An attacker targeting an enterprise running OpenClaw with Zalouser allowlist mode first identifies allowlisted group names through OSINT — documentation, job postings, or by probing agent responses from unauthenticated channels. The attacker then registers a new messaging group with a display name byte-for-byte identical to an allowlisted group (e.g., cloning 'SecOps-Alerts' or 'IT-Helpdesk'). Because OpenClaw's Zalouser mode evaluates the mutable display name rather than a stable group ID, the forged group passes authorization and messages are routed to the agent as if originating from the legitimate group. The attacker can now issue instructions to the AI agent directly — injecting prompts to exfiltrate data the agent has access to, invoking privileged tools to pivot into connected enterprise systems, or staging a persistent backdoor by poisoning the agent's memory or configuration through repeated authorized interactions. With CVSS AV:N/PR:N/UI:N, this entire chain requires no insider access or user interaction.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.