CVE-2026-32051
HIGH
openclaw
NVD
CVSS Score
8.8
Severity
HIGH
Published
Mar 21, 2026
Vendor
openclaw
Description
OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attackers with write-scope access can perform control-plane actions beyond their intended authorization level by exploiting inconsistent owner-only gating during agent execution.