CVE-2026-32039: Sender Policy Collision in OpenClaw

The core of this vulnerability lies in the way openclaw manages sender identities. The channels..groups..toolsBySender configuration setting could be manipulated by an attacker using a colliding mutable identity value, such as a shared senderName or senderUsername. This effectively allows a malicious sender to masquerade as a privileged sender, potentially gaining unauthorized access to resources or performing actions they shouldn't be able to. The impact is a potential bypass of sender policy controls, leading to unauthorized actions within the system. While the specific blast radius depends on the privileges associated with the targeted sender policy, successful exploitation could lead to significant data breaches or system compromise.

1. Reserved2026-03-10
2. Published2026-03-03
3. Modified2026-03-30
4. EPSS updated2026-03-27

The primary mitigation for CVE-2026-32039 is to upgrade the openclaw npm package to version 2026.2.22 or later. This version introduces explicit typed sender keys (id:, e164:, username:, name:) to prevent collisions. For environments where immediate upgrading is not feasible, consider temporarily migrating to the deprecated ID-only path for legacy untyped keys, although this is not a long-term solution. Review and tighten sender policy configurations to minimize the potential impact of a successful attack. After upgrading, confirm the fix by testing sender policy enforcement with various sender identities, ensuring that only authorized senders can access protected resources.