PT-2026-26420 · Openclaw · Openclaw

Jisung · Publicado 2026-03-03 · Atualizado 2026-03-20 · CVE-2026-32039

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description OpenClaw versions prior to 2026.2.22 contain an authorization bypass in the toolsBySender group policy matching. This allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender keys by forcing collisions with mutable identity values such as senderName or senderUsername to bypass sender-authorization policies and gain unauthorized access to privileged tools. The issue occurs when deployments use untyped keys, and the fix introduces explicit typed sender keys (id:, e164:, username:, name:), keeping legacy untyped keys on a deprecated ID-only path. The vulnerable component is channels.*.groups.*.toolsBySender.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Correção

Incorrect Authorization

IDOR

Enumeração de Fraquezas

CWE-863

CWE-639

Identificadores relacionados

CVE-2026-32039

GHSA-WPPH-CJGR-7C39

Produtos afetados

Openclaw

Referências · 8

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wpph-cjgr-7c39 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/5547a2275cb69413af3b62c795b93214fe913b57 · Correção
• https://osv.dev/vulnerability/GHSA-wpph-cjgr-7c39 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-sender-authorization-bypass-via-identity-collision-in-toolsbysender · Nota
• https://twitter.com/CVEnew/status/2034891578037178533 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32039 · Nota de Segurança