by Kastro
Paper/Archive/CVE-2026-32975

CVE-2026-32975

OpenClaw OpenClaw — OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.6.276 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.3.122026.3.12CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-f5mf-3r52-r83wwriteupvulncheck.com/advisories/openclaw-weak-authorization-via-mutable-group-names-in-zalouser-allowlist