Loading story…
Two high-severity vulnerabilities in OpenClaw exposed weaknesses in how the platform enforced messaging restrictions in its chat integrations. CVE-2026-32975 affects versions before 2026.3.12 and stems from weak authorization in Zalouser allowlist mode, where access checks used mutable group display names instead of stable group identifiers. That design allowed an attacker to create a group with the same name as an allowlisted group and bypass channel authorization, potentially causing messages from unintended groups to be routed to the agent.
A second flaw, CVE-2026-33578, affects versions before 2026.3.28 in the Google Chat and Zalouser extensions. In that case, route-level group allowlist policies could silently downgrade to an open sender policy, letting attackers bypass configured sender restrictions and interact with bots that should have been limited to approved groups. Both issues were rated high severity with impact to confidentiality, integrity, and availability, and advisories and code references were published alongside fixes in newer OpenClaw releases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A high-severity vulnerability, CVE-2026-33578, was publicly disclosed affecting OpenClaw versions before 2026.3.28. The flaw was classified as CWE-863 and described as a policy resolution weakness that let attackers interact with bots despite configured allowlist controls.
A high-severity vulnerability, CVE-2026-32975, was publicly disclosed affecting OpenClaw versions before 2026.3.12. The issue was classified as CWE-807 and described as enabling unauthorized message routing from unintended groups to the agent.
OpenClaw released version 2026.3.28 to fix a sender policy allowlist bypass affecting the Google Chat and Zalouser extensions. The bug caused route-level group allowlist policies to silently downgrade to an open policy, allowing attackers to bypass sender restrictions.
OpenClaw released version 2026.3.12 to address a weak authorization issue in Zalouser allowlist mode, where mutable group display names were used instead of stable group identifiers. The flaw could let attackers create similarly named groups and bypass channel authorization controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in OpenClaw exposed paths for authenticated users to gain access beyond their intended roles. **CVE-2026-32042** affects versions before `2026.2.25` and allows an attacker with valid shared gateway authentication to present a self-signed, unpaired device identity and bypass pairing requirements, then self-assign elevated operator scopes including `operator.admin`. The issue is classified as `CWE-863` and effectively turns a trusted but unapproved device identity into a route for privilege escalation. A second flaw, **CVE-2026-32051**, affects OpenClaw versions before `2026.3.1` and allows users with `operator.write` scope to reach owner-only tool surfaces such as gateway and cron through agent runs in scoped-token deployments. The authorization mismatch lets lower-privileged authenticated users perform control-plane actions that should be restricted to owners, creating high risk to confidentiality, integrity, and availability. Advisories for both issues point to fixes and security guidance through GitHub and VulnCheck.
Jun 29, 2026
OpenClaw disclosed several high-severity vulnerabilities affecting multiple releases, including authorization bypass in QQBot pre-dispatch slash commands, privilege escalation in the trusted-proxy Control UI WebSocket, and node authority expansion through pairing reconnection logic. The QQBot issue, tracked as **`CVE-2026-53834`** and mirrored in GitHub advisory **`GHSA-77pv-3w4q-vrj5`**, affects versions up to **`2026.4.26`** and allows senders to trigger slash-command handling before `allowFrom` policy checks are enforced. The vendor said the flaw is limited to the QQBot feature and its configuration, with the first stable fix released in **`2026.4.27`**.
Jun 29, 2026
Three high-severity flaws in the open-source AI coding assistant **OpenClaw** can be chained so that a single WhatsApp message leads to credential theft, privilege escalation, arbitrary code execution, and escape from the tool's Docker-based sandbox to the host. Researcher **Chinmohan Nayak** showed that attacker-crafted prompts disguised as normal debugging requests could exploit unsafe handling of untrusted input in OpenClaw `2026.6.1`, including an environment-variable filter bypass, command execution via Git's `ext::` transport helper, and a parent-directory bypass in sandbox bind mounts. The sandbox bypass could expose sensitive material such as **SSH keys**, **AWS credentials**, **GPG secrets**, and even the **Docker socket**, enabling broader compromise without any prior foothold on the target system. The issues are tracked as `GHSA-hjr6-g723-hmfm`, `GHSA-9969-8g9h-rxwm`, and `GHSA-575v-8hfq-m3mc`, and were fixed in **OpenClaw 2026.6.6**; users were urged to upgrade, enable sandbox mode for non-main sessions, restrict `exec` in tool allowlists, watch for malicious `git clone` activity involving the `ext::` protocol, limit direct-message pairing from untrusted numbers, and rotate credentials if exposure is suspected.
Jul 10, 2026