CVE-2026-32006

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32006
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. Remote attackers can send messages and reactions as DM-paired identities without explicit groupAllowFrom membership to bypass group sender authorization checks.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b7284279ce9 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-25pw-4h6w-qwvm Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-dm-pairing-store-fallback-in-group-allowlist Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

24 Mar 2026, 21:22

Type Values Removed Values Added
References () https://github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b7284279ce9 - () https://github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b7284279ce9 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-25pw-4h6w-qwvm - () https://github.com/openclaw/openclaw/security/advisories/GHSA-25pw-4h6w-qwvm - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-dm-pairing-store-fallback-in-group-allowlist - () https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-dm-pairing-store-fallback-in-group-allowlist - Third Party Advisory
Summary
  • (es) Versiones de OpenClaw anteriores a 2026.2.26 contienen una vulnerabilidad de omisión de autorización donde las identidades del almacén de emparejamiento de DM son tratadas incorrectamente como identidades de lista de permitidos de grupo cuando dmPolicy=pairing y groupPolicy=allowlist. Atacantes remotos pueden enviar mensajes y reacciones como identidades emparejadas por DM sin una membresía explícita de groupAllowFrom para omitir las comprobaciones de autorización del remitente del grupo.
First Time Openclaw openclaw
Openclaw
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

19 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-19 22:16

Updated : 2026-03-24 21:22

NVD link : CVE-2026-32006

Mitre link : CVE-2026-32006

CVE.ORG link : CVE-2026-32006

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-863

Incorrect Authorization