CVE-2026-32051

HIGH

OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-32051 has a selected CVSS score of 8.7 (high); EIP currently links 1 curated repository PoC.

Description

OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attackers with write-scope access can perform control-plane actions beyond their intended authorization level by exploiting inconsistent owner-only gating during agent execution.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 23, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

OpenClaw

Browse OpenClaw / OpenClaw

Default status: unaffected

CVE ListBefore 2026.3.1affected
2026.3.1unaffected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-32013Curated repository PoCby SecureWithUmer34Scanner9 files

C++ · 64.6 KiB · linked to 13 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that detects the installed version of OpenClaw and compares it against a known secure version to report vulnerability status. It does not exploit any vulnerability; it only checks the version and displays static CVE information.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single bash script (cve-scan.sh) that acts as a version scanner and informational reporter for OpenClaw CVEs. It detects the installed OpenClaw version, compares it against a hardcoded latest secure version, and displays pre-written CVE descriptions and statistics. No backdoor, concealed executable behavior, or operator-directed harm is present. The script does not download, execute, or install any payload; it only reads local version information and prints text to stdout.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareOpenClaw
Attack typesnone
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to check the version of OpenClaw and report whether it is vulnerable based on a hardcoded comparison. It does not contain any code to exploit a vulnerability, such as sending malicious payloads, triggering command injection, or performing unauthorized actions. It only detects and reports exposure, which is characteristic of a scanner.

hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420

Requirements

  • OpenClaw must be installed and accessible in the system PATH for automatic version detection.hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66

Observed behavior

  • Detects the installed OpenClaw version by executing 'openclaw --version'.hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66
  • Compares the detected version against a hardcoded latest secure version (v2026.3.1) to determine if the installation is vulnerable.hargabyte-cve-scanner-ba936e9/cve-scan.sh:124-133
  • Displays a static list of CVE identifiers and descriptions, along with general statistics about OpenClaw vulnerabilities.hargabyte-cve-scanner-ba936e9/cve-scan.sh:153-189
  • Outputs a recommendation to update OpenClaw if the version is found to be vulnerable.hargabyte-cve-scanner-ba936e9/cve-scan.sh:247-252
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Purpose
Payload withheldThe script's sole function is to check the local OpenClaw version and display vulnerability information. It contains no network calls, file writes, or process execution beyond reading the OpenClaw version.hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420
Hardcoded Urls
Payload withheldThese URLs appear only in the generated report text and are not fetched or used by the script. They are informational references.hargabyte-cve-scanner-ba936e9/cve-scan.sh:355-357
Review boundaries

What the analysis did not establish

  • The evidence packet contains only one text file (cve-scan.sh) out of 9 total files in the artifact. The other 8 files are unclassified and their content is not provided, so the analysis is based solely on the supplied script.
  • The script's vulnerability database is referenced as a separate JSON file (vulnerability-db.json) which is not included in the evidence, so the completeness of its CVE data cannot be verified.
  • Only the single text file cve-scan.sh was provided; 8 unclassified files totaling 53685 bytes were present in the artifact but not analyzed. Their content is unknown.
  • The review is based solely on static analysis of the supplied text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3