CVE-2026-32050 is an access control vulnerability affecting OpenClaw versions prior to 2026.2.25, allowing unauthorized senders to enqueue signal reaction status events. This flaw, identified as CWE-863, enables attackers to bypass authorization checks by exploiting a specific event path to queue status lines without proper DM or group access validation. Rated as Medium severity with a CVSS score of 5.3, it has a network attack vector, low attack complexity, and requires no privileges or user interaction, leading to a low impact on data integrity. There is currently no evidence of active exploitation, nor is public exploit code available in Metasploit, Nuclei, or ExploitDB, and community discussion remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 2026.2.25CPE match | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | ||
< 2026.2.25CPE matchmatch criteria | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.