Authorization Bypass in OpenClaw Zalouser Allowlist via Group Name Collision

Executive Summary

CVE-2026-32975 is a weak authorization vulnerability in OpenClaw versions before 2026.3.12, specifically in the Zalouser allowlist mode.

The vulnerability occurs because the system uses mutable group display names instead of stable, immutable group identifiers to make authorization decisions.

Attackers can exploit this by creating groups with the same names as allowlisted groups, allowing them to bypass channel authorization controls.

This enables unauthorized groups to route messages to the agent, potentially leading to unauthorized access or information disclosure.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized groups to bypass channel authorization and potentially access or disclose information by exploiting weak authorization based on mutable group names instead of stable identifiers.

Such unauthorized access or information disclosure could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on access to sensitive data and protection against unauthorized disclosure.

Therefore, if exploited, this vulnerability could lead to violations of data protection and privacy requirements mandated by these regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass channel authorization by impersonating allowlisted groups through identical group names.

As a result, unauthorized messages from unintended groups can be routed to the agent, potentially leading to unauthorized access or disclosure of sensitive information.

The impact includes compromised confidentiality and integrity of communications within the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade OpenClaw to version 2026.3.12 or later.

This update fixes the weak authorization issue by enforcing allowlist authorization using stable, immutable group identifiers instead of mutable group display names.

Useful 0 Not Useful 0