Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-32035 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Openclaw Openclaw. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32035 is an authorization vulnerability in OpenClaw versions prior to 2026.3.2, published on 2026-03-19. The issue occurs in the agentCommand function during processing of Discord voice transcripts, where the senderIsOwner flag is not passed, causing it to default to true. This leads to incorrect authorization checks, mapped to CWE-863 (Incorrect Authorization), with a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
Non-owner voice participants with low privileges (PR:L) in mixed-trust channels can exploit this by sending crafted Discord voice transcripts, requiring user interaction (UI:R) and high attack complexity (AC:H). Successful exploitation grants unauthorized access to owner-only tools, including gateway and cron functionality, resulting in high integrity impact (I:H), low confidentiality and availability impacts (C:L/A:L), with no scope change (S:U).
Advisories from GitHub (GHSA-wpg9-4g4v-f9rc) and VulnCheck recommend updating to OpenClaw version 2026.3.2 or later, which addresses the omission by properly passing the senderIsOwner flag during Discord voice transcript processing.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13318
Vulnerability Data
OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron…
more
functionality in mixed-trust channels.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass (missing senderIsOwner flag) directly enables T1068 by allowing low-priv users to invoke owner-only functions; explicit cron access enables T1053.003 for scheduled execution/persistence.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly preventing non-owner voice participants from accessing owner-only tools due to the omitted senderIsOwner flag.
Requires explicit authorization decisions based on access control policies before granting access, countering the incorrect default to true for senderIsOwner in agentCommand processing.
Implements least privilege to restrict non-owners to only necessary accesses, mitigating unauthorized use of gateway and cron functionality in mixed-trust channels.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.
By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.