Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-29 | 4 | Disclosure3Patch1 |
| 2026-03-30 | 1 | Patch1 |
🚨 CVE-2026-32924 — CVSS 9.8/10 ██████████ OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/wa3CN0RlOk
Post summary
The tweet announces CVE‑2026‑32924, a critical authorization‑bypass flaw with a CVSS score of 9.8, and urges users to apply the available patch immediately.
🚨 Critical CVEs Today: OpenClaw Platform (CVSS 9.8-9.9) Affected: OpenClaw Platform OpenClaw components expose multiple high-severity flaws spanning privilege escalation, authorization bypass, and pairing verification risks. - CVE-2026-32922 (CVSS 9.9) OpenClaw before 2026.3.11 contains a privilege escalation in device.token.rotate that can let callers with operator.pairing scope mint tokens with broader scopes; attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via http://system.run or gain unauthorized gateway-admin access. Affected versions: before 2026.3.11. - CVE-2026-32924 (CVSS 9.8) OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats, enabling bypass of groupAllowFrom and requireMention protections in group chat reaction-derived events. Affected versions: before 2026.3.12. - CVE-2026-32973 (CVSS 9.8) OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths; attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators. Affected versions: before 2026.3.11. - CVE-2026-32975 (CVSS 9.8) OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers; attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent. Affected versions: before 2026.3.12. - CVE-2026-32987 (CVSS 9.8) OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts; attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin. Affected versions: before 2026.3.13. 🛠️ Action • Patch/upgrade to fixed OpenClaw versions 2026.3.11+ for CVE-2026-32922 and CVE-2026-32973, 2026.3.12+ for CVE-2026-32924 and CVE-2026-32975, and 2026.3.13+ for CVE-2026-32987. • Prioritize internet-facing instances and edge appliances first. • If no fix yet appears for any CVE, apply vendor-murnished mitigations and reduce exposure (disable feature/module, restrict access). • Add detections for exploitation patterns (token-rotation misuse, reaction-event anomalies, unusual path-matching behaviors, and replay attempts in pairing flows). • Hunt for indicators around the affected services during disclosure-to-now window (logs, EDR, WAF). • Validate remediation (version checks, config verification) and monitor for reversion
Post summary
The message discloses several high‑severity CVEs in OpenClaw Platform, provides detailed technical information, and recommends patching and mitigation steps, but does not mention active exploitation or PoC availability.
CVE-2026-32924 OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations in… https://www.cve.org/CVERecord?id=CVE-2026-32924
Post summary
The post discloses an authorization bypass in OpenClaw pre‑2026.3.12, detailing how omitted chat_type in Feishu reaction events causes misclassification, but provides no PoC, exploit code, patch information, or evidence of active exploitation.
🔴 CVE-2026-32924 - Critical OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats.... https://www.thehackerwire.com/vulnerability/CVE-2026-32924/ https://t.co/eytqOjRCx4
Post summary
The tweet announces a critical authorization bypass in OpenClaw pre‑2026.3.12 affecting Feishu reaction events, providing specific technical details but no PoC, patch, or evidence of active exploitation.
[CVE-2026-32924: CRITICAL] OpenClaw discovered an authorization bypass vulnerability before 2026.3.12. Attackers can exploit this to bypass group chat protections by misclassifying events as p2p conversation...#cve,CVE-2026-32924,#cybersecurity https://cvefind.com/CVE-2026-32924
Post summary
OpenClaw announces CVE‑2026‑32924 as a critical authorization bypass flaw that lets attackers evade group chat protections by marking conversations as peer‑to‑peer.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |