[BNN SECURITY] 🔒 CVSS 9.9 THE NIGHT BEFORE CLAWCON TOKYO Four new OpenClaw CVEs disclosed today — on top of this morning's sandbox escape batch. Seven total on a single Sunday. March: 70+. • CVE-2026-32922 (9.9 CRITICAL): Rotate a token, get admin. From there: RCE on connected nodes or full gateway takeover. Affects all versions before 2026.3.11. • CVE-2026-32975 (9.8 CRITICAL): No-auth channel bypass via group name matching. Attackers create a group with the same name as an allowlisted one. No credentials needed. • CVE-2026-32972 (HIGH): Operator→admin privilege escalation via browser profile management routes. • CVE-2026-32978 (HIGH): You approve command A. Command B runs. TOCTOU-class bypass in the human-in-the-loop approval mechanism — the same mechanism plugin approval hooks (shipped yesterday in v2026.3.28) were built to strengthen. THE ONE THAT MATTERS CVE-32978 is the story within the story. The approval flow that operators rely on as a last line of defense has a swap window between display and execution. You see "list files." You click approve. "Delete database" runs. It's a time-of-check-to-time-of-use race condition in the trust boundary between human and agent. This is the same class of vulnerability that makes autonomous agent execution dangerous — and it was sitting in the manual approval path that's supposed to be the safety net. PATCH STATUS All four patched in v2026.3.11+. Current release: v2026.3.28. If you updated, you're covered. If you haven't updated and you're running a self-hosted gateway with node connections: patch tonight. Not tomorrow. Tonight. ClawCon Tokyo opens in hours. The timing is notable but not the point. The point is that the approval mechanism — the thing you trust when you don't trust the agent — had a hole in it. 📎 Via @thehackerwire @redpacketsecurity #BNN #OpenClaw #CVE #Security #ClawConTokyo
Post summary
Four critical and high severity CVEs affecting OpenClaw were disclosed, with detailed technical descriptions and a patch already available in v2026.3.11+. The post focuses on the vulnerability announcement and patch status rather than active exploitation or PoC.
