Which versions of Openclaw are affected by CVE-2026-32919?

Organizations using OpenClaw before 2026.3.11 should be aware of notable risk from CVE-2026-32919, a incorrect authorization vulnerability rated CVSS 6.9.. A patch is available.

How to fix or mitigate CVE-2026-32919?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openclaw CVE-2026-32919

Q: What is the CVSS score of CVE-2026-32919?

CVE-2026-32919 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17001 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

GHSA-jgqj-5ggg-rgg4

Authentication Bypass Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.11

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17001

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privileges.

AnalysisAI

OpenClaw before version 2026.3.11 allows authenticated operators with write-scoped permissions to bypass authorization controls and execute admin-only session reset functionality. Attackers holding operator.write privileges can issue agent requests containing /new or /reset slash commands to reset conversation state without requiring operator.admin credentials, resulting in unauthorized modification of session data. This vulnerability has a CVSS score of 6.9 and affects the core authorization logic that protects sensitive administrative operations.

Technical ContextAI

OpenClaw implements a scope-based authorization model where API callers are granted specific privileges such as operator.write and operator.admin. The vulnerability exists in the slash command processing logic for agent requests, where authorization checks fail to properly enforce the elevation requirement between write-scoped and admin-scoped operations. The root cause falls under CWE-863 (Incorrect Authorization), indicating a flaw in the access control mechanism that protects the /new and /reset endpoints. These commands directly manipulate conversation session state, which should be restricted to administrative users. The vulnerability affects all versions of the OpenClaw application prior to 2026.3.11, as identified in the CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: OpenClaw 2026.3.11 or later. Organizations should immediately upgrade to version 2026.3.11 to remediate the authorization bypass. If immediate patching is not possible, administrators should review and restrict the assignment of operator.write scope to trusted users only, and implement additional access controls or monitoring on agent requests containing /new and /reset slash commands. Consult the GitHub Security Advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-jf6w-m8jw-jfxc) for additional context and guidance from the OpenClaw maintainers.