CVE-2026-32975: Authorization Bypass in OpenClaw

The impact of this vulnerability is significant. An attacker can leverage it to bypass channel authorization within OpenClaw, effectively gaining unauthorized access to sensitive information or control over communication flows. By crafting groups with display names identical to legitimate, allowlisted groups, an attacker can route messages intended for authorized channels to their own agent, potentially exfiltrating data or injecting malicious commands. This could lead to a complete compromise of the OpenClaw instance and the systems it interacts with, depending on the nature of the data being handled and the permissions of the affected agent.

1. Reserved2026-03-17
2. Published2026-03-29
3. Modified2026-03-30
4. EPSS updated2026-04-06

The primary mitigation for CVE-2026-32975 is to immediately upgrade OpenClaw to version 2026.3.12 or later. If upgrading is not immediately feasible, consider implementing stricter group name validation policies to prevent the creation of groups with names that could be used to spoof legitimate groups. While not a complete solution, this can reduce the attack surface. Review OpenClaw's configuration to ensure the 'Zalouser allowlist mode' is appropriately configured and monitored for suspicious activity. There are no specific WAF or proxy rules that can directly address this vulnerability, as it resides within the application logic.