PT-2026-26732 · Openclaw · Openclaw

Tdjackey · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32050

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.25

Description The software contains an access control issue in how signal reaction notifications are handled. This allows unauthorized senders to add status events before authorization is confirmed. Specifically, attackers can use the reaction-only event path within the event-handler.ts file to queue signal reaction status lines for sessions without proper Direct Message (DM) or group access validation.

Recommendations Update to version 2026.2.25 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-32050

GHSA-792Q-QW95-F446

GHSA-86JJ-29WC-7Q2W

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/2aa7842adeedef423be7ce283a9144b9f1a0a669 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-792q-qw95-f446 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86jj-29wc-7q2w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-792q-qw95-f446 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32050 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2035262086058565666 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unauthorized-reaction-status-event-enqueue-via-access-check-bypass · Note