CVE-2026-32916
CRITICALOpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes
Title source: cnaDescription
OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-xw77-45gv-p728)
https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-plugin-subagent-routes-via-synthetic-admin-scopes
Scores
CVSS v3
9.4
EPSS
0.0046
EPSS Percentile
36.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-266
Status
published
Products (4)
npm/openclaw
2026.3.7 - 2026.3.11npm
OpenClaw/OpenClaw
2026.3.11
OpenClaw/OpenClaw
2026.3.7 - 2026.3.11
openclaw/openclaw
2026.3.7 - 2026.3.11
Published
Mar 31, 2026
Tracked Since
Mar 31, 2026