CVE-2026-32001

MEDIUM EPSS 18.3%
Published Mar 19, 20263mo ago · Modified Mar 23, 20263mo ago
5.3 CVSS 4.0
Medium
Find Similar
Published Mar 19, 2026 3mo ago
Last Modified Mar 23, 2026 3mo ago

Description

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject unauthorized node.event calls, triggering agent.request and voice.transcript flows without proper device pairing.

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
18.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
openclawopenclaw* <2026.2.22

References 3

  • github.com https://github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg
    PatchVendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-node-role-device-identity-bypass-via-websocket-authentication
    Third Party Advisory

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg
    PatchVendor Advisory