CVE-2026-32001: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32001 is an incorrect authorization vulnerability in OpenClaw (npm package) that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Reported by researcher @tdjackey and published on March 19, 2026, it affects all OpenClaw versions up to and including 2026.2.21-2 (Node.js/npm). The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, VulnCheck).

The root cause is CWE-863 (Incorrect Authorization): the WebSocket connection handler in src/gateway/server/ws-connection/message-handler.ts allowed the canSkipDevice flag to be set to true whenever shared-token authentication succeeded, regardless of the requested role. This meant a client claiming role=node during the WebSocket handshake could bypass device identity/pairing checks entirely. The fix changed the condition from const canSkipDevice = sharedAuthOk to const canSkipDevice = role === "operator" && sharedAuthOk, ensuring device identity is required for node-role connections even when shared-token auth passes (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated client (holding only a shared gateway token) to inject unauthorized node.event calls, triggering agent.request and voice.transcript flows without proper device pairing. This results in limited confidentiality impact (access to sensitive voice transcripts) and limited integrity impact (unauthorized triggering of agent execution flows), with no availability impact. The scope is limited to the OpenClaw gateway component, but the exposure of voice transcript data and the ability to trigger agent workflows represent meaningful risks in deployments handling sensitive audio or automation tasks (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (VulnCheck). The vulnerability requires low privileges (possession of a shared gateway token) and no user interaction, making it relatively straightforward to attempt for any authenticated client. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain a shared gateway token: Acquire a valid shared gateway token for the target OpenClaw instance — this may be obtained through legitimate access, credential exposure, or token leakage.
2. Initiate a WebSocket connection: Connect to the OpenClaw gateway WebSocket endpoint (e.g., wss://<target>/gateway).
3. Claim the node role during handshake: Send a connect request message specifying role: "node" along with the shared gateway token and a null or absent device field, e.g.:

   { "type": "connect", "role": "node", "token": "<shared_token>", "device": null, "client": { "id": "node-host", "version": "1.0.0", "platform": "test", "mode": "node" } }

4. Bypass device identity check: On vulnerable versions, the gateway sets canSkipDevice = sharedAuthOk = true, allowing the handshake to succeed without device pairing verification.
5. Inject unauthorized node events: With the node role established, send node.event messages to trigger agent.request and voice.transcript flows, accessing sensitive voice transcripts or invoking agent execution beyond the client's authorized scope (GitHub Advisory, GitHub Commit).

• Network: WebSocket connections to the OpenClaw gateway where the handshake connect message specifies role: "node" with a null or missing device field; unexpected node.event messages originating from clients not associated with registered node devices.
• Logs: Gateway logs showing successful role=node connections from clients lacking device identity or pairing records; agent.request or voice.transcript events triggered by clients not matching known paired devices.
• Application Behavior: Unexpected agent executions or voice transcript retrievals not correlated with legitimate paired node devices; audit log entries for node-role WebSocket sessions from unrecognized client IDs (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.2.22 or later, which enforces device identity verification for all role=node WebSocket connections regardless of shared-token authentication status (GitHub Commit, GitHub Advisory). As interim mitigations, restrict distribution of shared gateway tokens to trusted and verified systems only, implement network segmentation to limit access to the OpenClaw gateway from untrusted networks, and monitor WebSocket connections for unauthorized node-role claims and anomalous node.event activity.