VulnSocial

CVE-2026-32001Disclosure(openclaw / openclaw)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject unauthorized node.event calls, triggering agent.request and voice.transcript flows without proper device pairing.

openclaw CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-20: 2Patch / Workaround · 2026-03-20: 1Technical Details · 2026-03-20: 203-20
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Alex | The AI Practicalist@aipracticalist
    Disclosure

    OpenClaw had 10 CVEs published today in a single batch: CVE-2026-32001 through 32010. Auth bypasses, sandbox escapes, path traversal. All patched in versions from the past 4 weeks. If you run OpenClaw, check your version now. https://github.com/openclaw/openclaw/security/advisories

    Post summary

    Ten new CVEs for OpenClaw, covering auth bypasses, sandbox escapes, and path traversal, were published today; all are addressed in recent patches distributed within the last month.

    0000036
    21 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-32001 OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=n… https://www.cve.org/CVERecord?id=CVE-2026-32001

    Post summary

    The text announces CVE-2026-32001, an authentication bypass in OpenClaw before version 2026.2.22, but provides no PoC, exploit, patch, or evidence of real‑world exploitation.

    00000140
    56.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities