CVE-2026-32001

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32001
OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject unauthorized node.event calls, triggering agent.request and voice.transcript flows without proper device pairing.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg Patch Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-node-role-device-identity-bypass-via-websocket-authentication Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

23 Mar 2026, 18:51

Type Values Removed Values Added
References () https://github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e - () https://github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg - () https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg - Patch, Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-node-role-device-identity-bypass-via-websocket-authentication - () https://www.vulncheck.com/advisories/openclaw-node-role-device-identity-bypass-via-websocket-authentication - Third Party Advisory
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
First Time Openclaw openclaw
Openclaw
Summary
  • (es) Versiones de OpenClaw anteriores a 2026.2.22 contienen una vulnerabilidad de omisión de autenticación que permite a los clientes autenticados con un token de pasarela compartido conectarse como role=node sin verificación de identidad del dispositivo. Los atacantes pueden explotar esto al reclamar el rol de nodo durante el handshake de WebSocket para inyectar llamadas no autorizadas a node.event, desencadenando flujos de agent.request y voice.transcript sin el emparejamiento adecuado del dispositivo.

19 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-19 22:16

Updated : 2026-03-23 18:51

NVD link : CVE-2026-32001

Mitre link : CVE-2026-32001

CVE.ORG link : CVE-2026-32001

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-863

Incorrect Authorization