Platform
nodejs
Component
openclaw
Fixed in
2026.3.12
CVE-2026-32924 describes an authorization bypass vulnerability discovered in OpenClaw. This flaw allows attackers to circumvent group chat protections within the application by manipulating Feishu reaction events. The vulnerability affects versions of OpenClaw prior to 2026.3.12, and a patch has been released to address the issue.
The core of this vulnerability lies in how OpenClaw handles Feishu reaction events. Specifically, when a reaction event lacks the chat_type parameter, OpenClaw incorrectly classifies it as a peer-to-peer (p2p) conversation instead of a group chat. This misclassification bypasses crucial security measures, namely groupAllowFrom and requireMention protections. An attacker can exploit this to trigger actions or access data within group chats without proper authorization, potentially leading to unauthorized data modification, information disclosure, or even complete control over group chat functionality. The impact is particularly severe given the potential for widespread access and manipulation within group environments.
CVE-2026-32924 was publicly disclosed on 2026-03-29. Currently, there is no indication of active exploitation or a public proof-of-concept. The vulnerability's severity is rated CRITICAL (CVSS 9.8), indicating a high potential for exploitation if left unaddressed. It has not been added to the CISA KEV catalog at the time of this writing.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-32924 is to upgrade OpenClaw to version 2026.3.12 or later. This patched version correctly handles Feishu reaction events and enforces the intended group chat protections. If immediate upgrading is not feasible, consider implementing temporary workarounds by carefully validating the chattype parameter in incoming Feishu reaction events within your OpenClaw integration. While not a complete fix, this can reduce the attack surface. Monitor OpenClaw logs for unusual activity related to Feishu reaction events, specifically looking for events lacking the chattype parameter. After upgrading, confirm the fix by sending a test Feishu reaction event with an omitted chat_type and verifying that it is correctly classified as a group chat and subject to the appropriate protections.
Update OpenClaw to version 2026.3.12 or later. This version corrects the authorization bypass vulnerability by correctly classifying Feishu reaction events.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-32924 is a critical vulnerability in OpenClaw where Feishu reaction events without a chat_type are misclassified, allowing attackers to bypass group chat protections.
You are affected if you are running OpenClaw versions 0–2026.3.12 and integrate with Feishu. Upgrade to 2026.3.12 to mitigate the risk.
Upgrade OpenClaw to version 2026.3.12 or later. As a temporary workaround, validate the chat_type parameter in incoming Feishu reaction events.
There is currently no evidence of active exploitation or a public proof-of-concept for CVE-2026-32924.
Refer to the OpenClaw project's official security advisories and release notes for details on CVE-2026-32924 and the associated patch.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.