CVE-2026-32067

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32067
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf Patch
https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9 Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

26 May 2026, 14:16

Type Values Removed Values Added
Summary
  • (es) Versiones de OpenClaw anteriores a 2026.2.26 contienen una vulnerabilidad de omisión de autorización en el control de acceso del almacén de emparejamiento para la política de emparejamiento de mensajes directos que permite a los atacantes reutilizar aprobaciones de emparejamiento en múltiples cuentas. Un atacante aprobado como remitente en una cuenta puede ser aceptado automáticamente en otra cuenta en implementaciones multi-cuenta sin aprobación explícita, omitiendo los límites de autorización.
Summary (en) OpenClaw versions prior to 2026.2.26 contains an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries. (en) OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.

24 Mar 2026, 21:09

Type Values Removed Values Added
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
First Time Openclaw openclaw
Openclaw
References () https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf - () https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf - Patch
References () https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02 - () https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9 - () https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9 - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store - () https://www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store - Third Party Advisory

21 Mar 2026, 01:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-21 01:17

Updated : 2026-05-26 14:16

NVD link : CVE-2026-32067

Mitre link : CVE-2026-32067

CVE.ORG link : CVE-2026-32067

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-863

Incorrect Authorization