Cyber Resilience

CVE-2026-32897

Openclaw ≤ 2026.2.22

Public PoC
Published
21 March 2026
Modified
24 March 2026
Patch / advisory
View advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0026 18th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-32897 is a medium-severity an unspecified weakness vulnerability in Openclaw Openclaw. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts…

more

sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.

CWE(s)
CWE-320

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Reuse of auth token as hash secret directly enables derivation/exposure of application credentials (unsecured credentials).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-41357Same product: Openclaw Openclaw
CVE-2026-33575Same product: Openclaw Openclaw
CVE-2026-35644Same product: Openclaw Openclaw
CVE-2026-43528Same product: Openclaw Openclaw
CVE-2026-62211Same product: Openclaw Openclaw
CVE-2026-62213Same product: Openclaw Openclaw
CVE-2026-3691Same product: Openclaw Openclaw
CVE-2026-62214Same product: Openclaw Openclaw
CVE-2026-41368Same product: Openclaw Openclaw
CVE-2026-28463Same product: Openclaw Openclaw

Affected Assets

openclaw
openclaw
≤ 2026.2.22

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-12 Cryptographic Key Establishment and Management
  • IA-5 Authenticator Management
  • SC-8 Transmission Confidentiality and Integrity
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-12 Cryptographic Key Establishment and Management good match
prevent

Directly requires proper cryptographic key management practices that prohibit reuse of authentication tokens as secrets for unrelated hashing/obfuscation functions.

IA-5 Authenticator Management good match
prevent

Mandates secure authenticator management, including generation and use of distinct secrets rather than dual-purposing gateway tokens across domains.

SC-8 Transmission Confidentiality and Integrity partial match
prevent

Requires cryptographic protection of information in transit, which would have prevented exposure of derived tokens via prompts sent to external providers.

References