CVE-2026-32005HIGH 8.1EPSS p20.6%

CVE-2026-32005CVE-2026-32005

Description

OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared workspace deployments. Unauthorized workspace members can bypass allowFrom restrictions and channel user allowlists to enqueue system-event text into active sessions.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS0.28% probability of exploitation · percentile 20.6% · 2026-08-03T12:00:16Z
Published2026-03-19
Last modified2026-03-24

Underlying weaknesses· 1

CWE-863

References

  1. https://github.com/openclaw/openclaw/commit/ce8c67c314b93f570f53c2a9abc124e1e3a54715
  2. https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr
  3. https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-interactive-callbacks-via-sender-check-skip

1

TypeTargetConfidenceTier
WeaknessIncorrect Authorizationcwe-8630%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-35652
CVE
CVE-2026-35674
CVE
CVE-2026-28392
CVE
CVE-2026-41303
CVE
CVE-2026-28473
CVE
CVE-2026-28448
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.