Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-32051

OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attackers with write-scope access can perform control-plane actions beyond their intended authorization level by exploiting inconsistent owner-only gating during agent execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.1affected
  • 2026.3.1unaffected
pkg:npm/openclaw

References