What is the CVSS score of CVE-2026-32050?

CVE-2026-32050 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32050?

CVE-2026-32050 is a low-severity vulnerability (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32050?

Yes, a public proof-of-concept exploit is available for CVE-2026-32050. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32050?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Openclaw CVE-2026-32050

EUVD-2026-13947 LOW

Incorrect Authorization (CWE-863)

2026-03-21 VulnCheck

Authentication Bypass Openclaw

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 23, 2026 - 17:08 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 01:00 euvd

EUVD-2026-13947

Analysis Generated

Mar 21, 2026 - 01:00 vuln.today

Patch released

Mar 21, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 21, 2026 - 00:42 nvd

LOW 3.7

DescriptionCVE.org

OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.

AnalysisAI

OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in the signal reaction notification handling mechanism that allows unauthenticated attackers to enqueue status events before authorization checks are performed. Attackers can exploit the reaction-only event path in event-handler.ts to inject signal reaction status lines into sessions without validating proper DM or group access permissions, resulting in integrity compromise. The vulnerability has a CVSS score of 3.7 (low-to-moderate severity) with an attack vector of network, high complexity, and no privileges required, though no active exploitation or public proof-of-concept has been confirmed in known exploit databases.

Technical ContextAI

The vulnerability resides in OpenClaw's event handling architecture, specifically in the event-handler.ts component that processes signal reaction notifications. The root cause is classified under CWE-863 (Incorrect Authorization), where access control checks are performed after event enqueueing rather than before. The affected product is identified via CPE as cpe:2.3:a:openclaw:openclaw (all versions prior to 2026.2.25). The flaw exploits the reaction-only event processing path, which bypasses standard DM (direct message) and group access validation mechanisms. This represents a classic broken access control pattern where the order of security operations—specifically post-enqueue validation instead of pre-enqueue validation—creates an authorization bypass window.

RemediationAI

Upgrade OpenClaw to version 2026.2.25 or later immediately, referencing the vendor patch commit 2aa7842adeedef423be7ce283a9144b9f1a0a669 available at https://github.com/openclaw/openclaw/commit/2aa7842adeedef423be7ce283a9144b9f1a0a669. Organizations unable to patch immediately should implement network-level access controls to restrict signal reaction event submission to trusted internal sources, disable or restrict direct message and group reaction features until patching is possible, and monitor event handler logs for suspicious reaction event enqueueing patterns that precede authorization failures. Review recent access logs for any evidence of unauthorized reaction status events being queued to sessions without proper group or DM permissions.