HIGH
OpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip
Published Mar 19, 2026
7.6
HIGHCVSS 4.0
EPSS 0.40%
Description
OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared workspace deployments. Unauthorized workspace members can bypass allowFrom restrictions and channel user allowlists to enqueue system-event text into active sessions.
Affected products
-
- Version 0StatusaffectedConstraints<2026.2.25
- Version 2026.2.25StatusunaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
openclaw
npm
Introduced 0 Fixed 2026.2.25
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | openclaw | 0 | 2026.2.25 |
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://github.com/advisories/GHSA-x2ff-j5c2-ggpr Advisory
- https://github.com/openclaw/openclaw/commit/ce8c67c314b93f570f53c2a9abc124e1e3a54715 patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-32005
- https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-interactive-callbacks-via-sender-check-skip third-party-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-x2ff-j5c2-ggpr | Advisory | |
| https://github.com/openclaw/openclaw/commit/ce8c67c314b93f570f53c2a9abc124e1e3a54715 | patch | |
| https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr | vendor-advisoryVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-32005 | ||
| https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-interactive-callbacks-via-sender-check-skip | third-party-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Mar 19, 2026
Updated Jun 23, 2026
Reserved Mar 10, 2026
Link CVE-2026-32005
CISA Vulnrichment
GHSA-X2FF-J5C2-GGPR Updated Mar 20, 2026