CVE-2026-32975
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Mar 29, 2026
CISA due date
—
The record
OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root… CWE-807
- CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-807
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-807
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-807
- CVE-2026-87479 Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36… CWE-807
- CVE-2026-82533 DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability… CWE-807
- CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain functions… CWE-807
- CVE-2026-85602 The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the… CWE-807