CVE-2026-32001
Authentication Bypass in OpenClaw Enables Unauthorized Node Role Access
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.2.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
OpenClaw versions prior to 2026.2.22 have an authentication bypass vulnerability. This flaw allows clients who are authenticated using a shared gateway token to connect with the role of 'node' without verifying the device's identity. Attackers can exploit this by claiming the node role during the WebSocket handshake process, which enables them to inject unauthorized node.event calls. These calls can trigger agent.request and voice.transcript flows without the device being properly paired.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass authentication controls and impersonate a node device. By doing so, they can inject unauthorized events and trigger agent requests and voice transcript flows without proper device pairing. This could lead to unauthorized access to system functions, manipulation of data flows, and potential disruption or misuse of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know