CVE-2026-32057
MEDIUM
openclaw
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Mar 21, 2026
Vendor
openclaw
Description
OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.