PT-2026-26387 · Openclaw · Openclaw

Tdjackey · Published 2026-03-04 · Updated 2026-03-20 · CVE-2026-32005

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.25

Description OpenClaw fails to enforce sender authorization checks for interactive callbacks, including block action, view submission, and view closed, in shared workspace deployments. This allows unauthorized workspace members to bypass restrictions and inject system-event text into active sessions. The issue does not provide unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation. The vulnerable component relies on sender restrictions such as allowFrom, DM policy, or channel user allowlists.

Recommendations Update to version 2026.2.25 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-32005

GHSA-X2FF-J5C2-GGPR

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/ce8c67c314b93f570f53c2a9abc124e1e3a54715 · Patch
• https://osv.dev/vulnerability/CVE-2026-32005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x2ff-j5c2-ggpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32005 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-interactive-callbacks-via-sender-check-skip · Note
• https://twitter.com/CVEnew/status/2034891609918120411 · Twitter Post