PT-2026-26746 · Openclaw · Openclaw

Aether Ai · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-32897

NVD

CVSS v3.1

3.7

Low

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

CVE-2026-32897

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/c99e7696e6893083b256f0a6c88fb060f3a76fb7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32897 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-v6x2-2qvm-6gv8 · Note
• https://vulncheck.com/advisories/openclaw-authentication-token-reuse-in-owner-id-prompt-hashing-fallback · Note