●PocketClawAI security alerts
Sign in
highCVSS 7.1NVD status: Modified

CVE-2026-32057

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification.

ComponentOpenClaw
Severityhigh (CVSS 7.1)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Published (NVD)2026-03-21
Last modified2026-06-17
Affected versions
openclaw < 2026.2.25
Fixed in2026.2.25
WeaknessCWE-807
CISA KEVnot listed

NVD description

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.

Does CVE-2026-32057 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for OpenClaw.
Check my stack

What to do

  • Upgrade OpenClaw to 2026.2.25 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other OpenClaw CVEs

medium
CVE-2026-108757CVSS 6.5

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips...

OpenClaw
2026-10-11high
CVE-2026-101884CVSS 7.5

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,...

OpenClaw
2026-09-30high
CVE-2026-101880CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe...

OpenClaw
2026-09-30medium
CVE-2026-101881CVSS 6.5

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th...

OpenClaw
2026-09-30medium
CVE-2026-101883CVSS 5.4

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U...

OpenClaw
2026-09-30high
CVE-2026-101882CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-exec...

OpenClaw
2026-09-30

All OpenClaw CVEs