Vulnerability Description
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.2.26 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b728427Patch
- https://github.com/openclaw/openclaw/commit/8bdda7a651c21e98faccdbbd73081e79cffePatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-jv6r-27ww-4gw4Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-dm-pairThird Party Advisory
FAQ
What is CVE-2026-32027?
CVE-2026-32027 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can ex...
How severe is CVE-2026-32027?
CVE-2026-32027 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32027?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.