Which versions of Openclaw are affected by CVE-2026-32924?

Organizations using OpenClaw before 2026.3.12 should be aware of notable risk from CVE-2026-32924, a incorrect authorization vulnerability rated CVSS 6.9.. A patch is available.

How to fix or mitigate CVE-2026-32924?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openclaw CVE-2026-32924

Q: What is the CVSS score of CVE-2026-32924?

CVE-2026-32924 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17007 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

GHSA-988c-qpg2-7hpv

Authentication Bypass Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.12

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17007

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.12.

DescriptionCVE.org

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.

AnalysisAI

OpenClaw before version 2026.3.12 permits authorization bypass in Feishu reaction event handling when chat_type parameters are omitted, causing group chat events to be misclassified as peer-to-peer conversations and allowing attackers to circumvent groupAllowFrom and requireMention security controls. Unauthenticated remote attackers can exploit this with low complexity to achieve partial confidentiality and integrity impacts. No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is understood.

Technical ContextAI

OpenClaw is a Feishu (DingTalk-alternative messaging platform) bot framework that enforces access controls via groupAllowFrom and requireMention directives on group chat reaction events. The vulnerability stems from improper input validation (CWE-863: Incorrect Authorization) in the event classification logic. When Feishu reaction events arrive without an explicit chat_type field, OpenClaw's code defaults to or misinterprets the event as a peer-to-peer (p2p) conversation rather than a group chat. This misclassification causes the authorization decision logic to skip group-specific restrictions, treating a group-sourced event with p2p rules. The root cause is insufficient validation of the chat_type parameter before the authorization decision is rendered.

RemediationAI

Upgrade OpenClaw to version 2026.3.12 or later immediately. This patched version restores proper validation of the chat_type parameter in Feishu reaction events, ensuring group chat events are correctly classified and subject to groupAllowFrom and requireMention protections. No workarounds for earlier versions are documented; patch deployment is the only remediation path. Consult the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-m69h-jm2f-2pv8 and VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-misclassified-reaction-events-in-feishu for patch deployment guidance and confirmation of successful update.