PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32067 OpenClaw CVE debrief

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.

Vendor
OpenClaw
Product
Unknown
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-21
Original CVE updated
2026-05-26
Advisory published
2026-03-21
Advisory updated
2026-05-26

Who should care

Organizations running multi-account OpenClaw deployments with direct message pairing functionality enabled. Security teams responsible for authorization boundary enforcement in Node.js applications. Administrators managing cross-account access controls in messaging or communication platforms.

Technical summary

The vulnerability exists in OpenClaw's pairing-store access control mechanism for direct message pairing policy. In multi-account deployments, the system fails to properly isolate pairing approvals between accounts. An attacker who obtains sender approval in one account can have that approval automatically accepted when attempting to pair with another account, effectively reusing authorization credentials across account boundaries. This represents an incorrect authorization control (CWE-863) where the pairing store does not validate that approvals are scoped to the specific account context. The vulnerability requires network access, high attack complexity, privileged access, and user interaction per the CVSS 4.0 vector.

Defensive priority

LOW

Recommended defensive actions

  • Upgrade to OpenClaw version 2026.2.26 or later to remediate the authorization bypass vulnerability in the pairing-store access control.
  • Review multi-account deployment configurations to ensure proper authorization boundaries are enforced between accounts.
  • Monitor for unauthorized cross-account pairing approvals in environments running affected versions.
  • Apply patches referenced in vendor security advisory if immediate upgrade is not feasible.

Evidence notes

CVE published 2026-03-21; modified 2026-05-26. CVSS 4.0 score 2.0 (LOW). CPE indicates affected versions prior to 2026.2.26 on Node.js. Two patches committed to GitHub repository. Vendor advisory published via GitHub Security Advisories. Third-party advisory from VulnCheck.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32067 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32067

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32067 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32067

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.