PT-2026-26420 · Openclaw · Openclaw

Jisung · Published 2026-03-03 · Updated 2026-03-20 · CVE-2026-32039

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description OpenClaw versions prior to 2026.2.22 contain an authorization bypass in the toolsBySender group policy matching. This allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender keys by forcing collisions with mutable identity values such as senderName or senderUsername to bypass sender-authorization policies and gain unauthorized access to privileged tools. The issue occurs when deployments use untyped keys, and the fix introduces explicit typed sender keys (id:, e164:, username:, name:), keeping legacy untyped keys on a deprecated ID-only path. The vulnerable component is channels.*.groups.*.toolsBySender.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-32039

GHSA-WPPH-CJGR-7C39

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/5547a2275cb69413af3b62c795b93214fe913b57 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wpph-cjgr-7c39 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32039 · Security Note
• https://osv.dev/vulnerability/GHSA-wpph-cjgr-7c39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32039 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2034891578037178533 · Twitter Post
• https://vulncheck.com/advisories/openclaw-sender-authorization-bypass-via-identity-collision-in-toolsbysender · Note