CVE-2026-32050
OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
- Record
CVE-2026-32050- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-13947
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
- Record
EUVD-2026-13947- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-792q-qw95-f446
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks
Summary
In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.24(latest published at patch time) - Fixed:
2026.2.25
Details
In the affected flow (src/signal/monitor/event-handler.ts), reaction-only handling could return after enqueueSystemEvent(...) before DM/group authorization checks were evaluated for that sender.
This behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session.
The fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged.
Impact
- Limited to Signal reaction-only inbound events.
- Could add an unauthorized reaction status line to agent context for affected sessions.
- Did not directly enable normal DM delivery or direct host command execution.
Fix Commit(s)
2aa7842adeedef423be7ce283a9144b9f1a0a669
Release Process Note
patched_versions is pre-set to 2026.2.25 so once npm release is out, advisory publish can proceed directly.
OpenClaw thanks @tdjackey for reporting.
- Record
GHSA-792q-qw95-f446- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
- Record
CVE-2026-32050- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
- Record
CVE-2026-32050- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-792q-qw95-f446
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks
Summary
In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.24(latest published at patch time) - Fixed:
2026.2.25
Details
In the affected flow (src/signal/monitor/event-handler.ts), reaction-only handling could return after enqueueSystemEvent(...) before DM/group authorization checks were evaluated for that sender.
This behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session.
The fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged.
Impact
- Limited to Signal reaction-only inbound events.
- Could add an unauthorized reaction status line to agent context for affected sessions.
- Did not directly enable normal DM delivery or direct host command execution.
Fix Commit(s)
2aa7842adeedef423be7ce283a9144b9f1a0a669
Release Process Note
patched_versions is pre-set to 2026.2.25 so once npm release is out, advisory publish can proceed directly.
OpenClaw thanks @tdjackey for reporting.
- Record
GHSA-792q-qw95-f446- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32050 is a medium vulnerability (CVSS 6.3) in Openclaw, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in openclaw 2026.2.25.
References
github.com/openclaw/openclaw/security/advisories/GHSA-792q-qw95-f446
vulncheck.com/advisories/openclaw-unauthorized-reaction-status-event-enqueue-via-access-check-bypass
nvd.nist.gov/vuln/detail/CVE-2026-32050