Which versions of Openclaw are affected by CVE-2026-32916?

OpenClaw versions 2026.3.7 through 2026.3.10 contain an authorization bypass that allows unauthenticated attackers to execute privileged gateway operations, including session deletion and agent…. A patch is available.

How to fix or mitigate CVE-2026-32916?

Within 24 hours: Inventory all OpenClaw deployments and identify systems running versions 2026.3.7-2026.3.10; isolate affected gateway instances from untrusted networks. Within 7 days: Implement network segmentation restricting access to plugin subagent routes to trusted sources only; review and revoke synthetic operator client credentials with unnecessary administrative scopes. Within 30 days: Upgrade to OpenClaw version 2026.3.11 or later once vendor releases patched version; validate all gateway operations and session management post-upgrade.

Openclaw CVE-2026-32916

Q: What is the CVSS score of CVE-2026-32916?

CVE-2026-32916 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17369 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-03-31 VulnCheck

GHSA-xw77-45gv-p728

Authentication Bypass Openclaw

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17369

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:17 nvd

CRITICAL 9.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.7.

DescriptionCVE.org

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.

AnalysisAI

Authorization bypass in OpenClaw 2026.3.7 through 2026.3.10 enables remote unauthenticated attackers to execute privileged gateway operations through plugin subagent routes. The vulnerability exploits synthetic operator clients with excessive administrative scopes, allowing attackers to delete sessions and execute agent commands without authentication. CVSS 7.7 (High) with network attack vector but high complexity (AC:H). No public exploit identified at time of analysis, though technical details are available via GitHub security advisory and VulnCheck analysis.

Technical ContextAI

This vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in OpenClaw's plugin architecture. The flaw exists in how plugin subagent routes interact with the gateway layer. When processing requests to plugin-owned routes, the system creates a synthetic operator client that is automatically granted broad administrative scopes without proper validation of the originating request's authentication status. This design flaw allows the runtime.subagent methods to be invoked with elevated privileges even when the HTTP request itself carries no valid authentication credentials. The affected component appears to be the plugin framework's routing and privilege elevation mechanism, where privilege assignment occurs at the service layer rather than being tied to the authenticated principal. The CPE identifier cpe:2.3:a:openclaw:openclaw confirms this affects the core OpenClaw application rather than a specific plugin.

RemediationAI

Upgrade immediately to OpenClaw version 2026.3.11 or later, which contains fixes for the privilege escalation issue in plugin subagent routing. The vendor-released patch addresses the synthetic operator client scope assignment flaw by implementing proper authentication verification before granting administrative privileges to plugin route handlers. Organizations unable to upgrade immediately should implement network-level access controls to restrict access to plugin subagent routes to trusted networks only, reducing exposure to unauthenticated remote attackers. Review audit logs for suspicious runtime.subagent method invocations, unexpected session deletions, or unauthorized agent executions that may indicate exploitation attempts. Consult the official GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728 for complete remediation guidance and any additional vendor-recommended compensating controls. Additional technical context is available from VulnCheck at https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-plugin-subagent-routes-via-synthetic-admin-scopes for organizations requiring deeper understanding before deployment of patches.