CVE-2026-32916: OpenClaw authorization bypass in plugin subagent routes

CVE-2026-32916 · Severity: critical · CVSS 9.4 · Published 2026-03-31

OpenClaw, a platform for managing agents and plugins, contains a security flaw in how it handles plugin requests. An attacker can send a specially crafted request to a plugin's web address to gain administrative control over the system without needing a password. This could allow an unauthorized person to delete user sessions, access sensitive data, or execute unauthorized commands on the server.

Technologies: openclaw (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-32916 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32916 being exploited in the wild.
How severe is CVE-2026-32916?
Critical severity, with a CVSS score of 9.4, published 31 March 2026.
Which products and versions are affected?
openclaw (npm) SEMVER:introduced=2026.3.7,fixed=2026.3.11; Openclaw >= 2026.3.7, < 2026.3.11.
Is there a fix for CVE-2026-32916?
Yes. openclaw (npm): upgrade to 2026.3.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32916 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32916?
Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openclaw (npm): upgrade to 2026.3.11 or later
    npm install openclaw@2026.3.11

Technical details

An authorization bypass exists in OpenClaw's plugin subagent runtime. When a plugin-owned HTTP route (using auth: 'plugin') invokes 'runtime.subagent.*' methods, the system dispatches these calls using a synthetic operator client that possesses broad administrative scopes rather than the caller's actual context. A remote, unauthenticated attacker can exploit this by sending requests to plugin-owned routes to perform privileged actions such as session deletion, reading session data, or triggering agent execution. The vulnerability is rooted in the failure to propagate the original caller's authentication context or enforce least-privilege scopes. This issue was fixed in version 2026.3.11 by ensuring the real gateway client is propagated and capping unauthenticated access to non-admin scopes.

Affected products

  • OpenClaw OpenClaw >= 2026.3.7, < 2026.3.11

Identifiers

  • CVE-2026-32916
  • GHSA-xw77-45gv-p728

Timeline

  • 2026-03-12: advisory: GitHub Security Advisory GHSA-xw77-45gv-p728 published
  • 2026-03-31: disclosed: CVE-2026-32916 published
  • 2026-03-11: patched: Fixed in version 2026.3.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.