Every CVE Search/ Get API key

CVE-2026-32057

OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter

6.0 MediumFix available

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.36%Up 0.3 points since Mar 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Record
CVE-2026-32057
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-807
Updated
2026-11-02
EUVDEUVD-2026-13960 6.0

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Record
EUVD-2026-13960
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vvgp-4c28-m3jm 6.0

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Summary

A trusted-proxy Control UI pairing bypass accepted client.id=control-ui without device identity checks. The bypass did not require operator role, so an authenticated node role session could connect unpaired and reach node event methods.

Impact

With trusted-proxy authentication enabled, a node role websocket client could skip pairing by using client.id=control-ui. That created an authorization boundary bypass from a node-scoped connection into node event execution flows.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected range: <= 2026.2.24
  • Latest published vulnerable version: 2026.2.24
  • Patched in next release: 2026.2.25 (pre-set below so this advisory is ready to publish after npm release)

Fix

The trusted-proxy Control UI bypass now additionally requires role === "operator".

Fix Commit(s)

  • ec45c317f5d0631a3d333b236da58c4749ede2a3

Release Process Note

patched_versions is intentionally pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.2.25` is published, the remaining GHSA action is to publish this advisory.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-vvgp-4c28-m3jm
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-807
Updated
2026-11-02
NVD 6.0

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Record
CVE-2026-32057
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-807
Updated
2026-11-02
OSV 6.0

OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Record
CVE-2026-32057
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-807
Updated
2026-11-02
OSVGHSA-vvgp-4c28-m3jm 6.0

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Summary

A trusted-proxy Control UI pairing bypass accepted client.id=control-ui without device identity checks. The bypass did not require operator role, so an authenticated node role session could connect unpaired and reach node event methods.

Impact

With trusted-proxy authentication enabled, a node role websocket client could skip pairing by using client.id=control-ui. That created an authorization boundary bypass from a node-scoped connection into node event execution flows.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected range: <= 2026.2.24
  • Latest published vulnerable version: 2026.2.24
  • Patched in next release: 2026.2.25 (pre-set below so this advisory is ready to publish after npm release)

Fix

The trusted-proxy Control UI bypass now additionally requires role === "operator".

Fix Commit(s)

  • ec45c317f5d0631a3d333b236da58c4749ede2a3

Release Process Note

patched_versions is intentionally pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.2.25` is published, the remaining GHSA action is to publish this advisory.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-vvgp-4c28-m3jm
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-807
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 through 2026.2.24
2026.2.25
openclaw
npm
 before 2026.2.25
2026.2.25

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32057 is a medium vulnerability (CVSS 6.0) in Openclaw, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in openclaw 2026.2.25.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open