🚨 Critical CVEs Today: OpenClaw Platform (CVSS 9.8-9.9) Affected: OpenClaw Platform OpenClaw components expose multiple high-severity flaws spanning privilege escalation, authorization bypass, and pairing verification risks. - CVE-2026-32922 (CVSS 9.9) OpenClaw before 2026.3.11 contains a privilege escalation in device.token.rotate that can let callers with operator.pairing scope mint tokens with broader scopes; attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via http://system.run or gain unauthorized gateway-admin access. Affected versions: before 2026.3.11. - CVE-2026-32924 (CVSS 9.8) OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats, enabling bypass of groupAllowFrom and requireMention protections in group chat reaction-derived events. Affected versions: before 2026.3.12. - CVE-2026-32973 (CVSS 9.8) OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths; attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators. Affected versions: before 2026.3.11. - CVE-2026-32975 (CVSS 9.8) OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers; attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent. Affected versions: before 2026.3.12. - CVE-2026-32987 (CVSS 9.8) OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts; attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin. Affected versions: before 2026.3.13. 🛠️ Action • Patch/upgrade to fixed OpenClaw versions 2026.3.11+ for CVE-2026-32922 and CVE-2026-32973, 2026.3.12+ for CVE-2026-32924 and CVE-2026-32975, and 2026.3.13+ for CVE-2026-32987. • Prioritize internet-facing instances and edge appliances first. • If no fix yet appears for any CVE, apply vendor-murnished mitigations and reduce exposure (disable feature/module, restrict access). • Add detections for exploitation patterns (token-rotation misuse, reaction-event anomalies, unusual path-matching behaviors, and replay attempts in pairing flows). • Hunt for indicators around the affected services during disclosure-to-now window (logs, EDR, WAF). • Validate remediation (version checks, config verification) and monitor for reversion
Post summary
The post discloses multiple high‑severity CVEs in the OpenClaw Platform, provides detailed technical and impact information, and recommends patching or mitigations.
