Openclaw · Openclaw · CVE-2026-32014
**Name of the Vulnerable Software and Affected Versions**
OpenClaw versions prior to 2026.2.26
**Description**
OpenClaw is affected by a metadata spoofing issue. The reconnect platform and deviceFamily fields are accepted from the client without being included in the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect metadata to bypass platform-based node command policies and gain access to restricted commands. The issue occurs because reconnect metadata was accepted from the client while these fields were not bound into the device-auth signature.
**Recommendations**
Versions prior to 2026.2.26 should be updated to version 2026.2.26 or later. Add device-auth payload `v3` that signs normalized `platform` and `deviceFamily`. Verify `v3` first (fallback to `v2` for compatibility), while pinning paired metadata server-side. Reject reconnect metadata mismatches and require explicit repair pairing to change pinned metadata. Add regression coverage for reconnect spoof attempts.