Loading vulnerability…
Authorization bypass in OpenClaw agent runs via owner-only tool access
CVE-2026-32051 is an authorization mismatch vulnerability in OpenClaw affecting versions prior to 2026.3.1. In scoped-token deployments, authenticated callers holding operator.write scope can invoke tool surfaces intended to be restricted to the owner role, including gateway and cron, by triggering agent runs. The flaw stems from inconsistent enforcement of owner-only gating during agent execution, causing authorization checks applied to direct access paths to be bypassed when the same functionality is reached through agent-run workflows.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged but authenticated user with operator.write scope to perform control-plane actions beyond their intended authorization level. Because the exposed owner-only surfaces include gateway and cron, the attacker can access high-impact administrative functionality and potentially affect confidentiality, integrity, and availability of the OpenClaw environment. The provided CVSS vectors and description indicate the resulting impact can be high across all three dimensions.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict or avoid granting operator.write scope to untrusted users, especially in scoped-token deployments. Limit access to agent-run functionality for non-owner users where feasible, and review whether owner-only surfaces such as gateway and cron are reachable indirectly through agent workflows. Additional compensating controls may include tighter token scoping, reducing exposure of privileged control-plane features, and monitoring for unexpected agent-run invocations targeting administrative tool surfaces. Specific vendor-provided mitigations beyond upgrading were not provided in the available content.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.3.1 or later. The vulnerable behavior affects versions prior to 2026.3.1. Remediation should ensure owner-only authorization checks are enforced consistently for agent-run execution paths as well as direct invocation paths, particularly for gateway, cron, and other privileged tool surfaces in scoped-token deployments.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.