Openclaw CVE-2026-32897

The CVSS v3.1 score of 3.7 reflects low immediate exploitability due to Attack Vector Network but high Attack Complexity (AC:H), requiring the attacker to intercept or access system prompts sent to external model providers—a non-trivial precondition. However, this low CVSS belies the severity of the underlying vulnerability. The vulnerability is not listed as actively exploited in KEV data based on available intelligence, and no public POC has been disclosed. From an SSVC perspective, the technical impact is high (authentication bypass potential) but exploitation requires either compromised third-party model provider visibility, prompt injection capabilities, or network interception—all moderate-to-high preconditions. The real risk lies in the cryptographic design flaw itself: any deployment where third-party providers log or process system prompts is potentially vulnerable. Organizations relying on OpenClaw for secure gateway authentication should prioritize patching regardless of CVSS score, as the separation of cryptographic domains is foundational to defense-in-depth.

An attacker gains visibility into system prompts sent to OpenAI, Claude, or another third-party model provider (via a compromised provider account, prompt logging service, or network interception). The attacker observes hash values in the owner-ID field where commands.ownerDisplay is set to hash. Since the hash was generated using the reused gateway.auth.token as the secret and commands.ownerDisplaySecret was not explicitly configured, the attacker can test candidate tokens or perform cryptanalysis against known hash values to recover the authentication token, then use this token to impersonate users or escalate privileges within the OpenClaw gateway itself. The high attack complexity requirement (provider visibility + prompt access) limits immediate widespread risk but is plausible in cloud or SaaS deployment contexts where audit logs are accessible to insiders or compromised.