CVE-2026-32897: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32897 is an authentication secret reuse vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.22 (specifically ≤ 2026.2.21-2). When commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is left unset, OpenClaw falls back to reusing gateway.auth.token (and gateway.remote.token) as the HMAC secret for owner-ID prompt obfuscation — creating dual-use of authentication credentials across two distinct security domains. The vulnerability was disclosed on March 21, 2026, with a patch released as version 2026.2.22. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is improper secret isolation — the same credential (gateway.auth.token) is used for both gateway authentication and as a fallback HMAC key for hashing owner IDs in system prompts sent to third-party AI model providers. This is a form of CWE-330 (Use of Insufficiently Random Values) or more precisely a secret reuse/dual-use design flaw. The vulnerable code paths exist in src/agents/cli-runner/helpers.ts, src/agents/pi-embedded-runner/run/attempt.ts, and src/agents/pi-embedded-runner/compact.ts, where the fallback chain commands.ownerDisplaySecret ?? gateway.auth.token ?? gateway.remote.token was used when constructing system prompts. An attacker who can observe system prompts forwarded to third-party model providers (e.g., via API interception or provider-side access) can collect hash outputs and, given sufficient samples, derive or brute-force the gateway authentication token (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker with visibility into system prompts sent to third-party model providers to derive the gateway authentication token from hash outputs, potentially enabling unauthorized access to the OpenClaw gateway and connected systems. The advisory notes there is no direct plaintext token disclosure; practical risk is highest when operators use weak (low-entropy) gateway tokens and leave commands.ownerDisplaySecret unset. Confidentiality is the primary impact (gateway credential exposure), with no direct integrity or availability impact (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.05%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to have access to system prompts forwarded to third-party model providers, which is a non-trivial precondition, and the attack complexity is rated High under CVSS v4.0 due to the requirement for specific deployment conditions (commands.ownerDisplay=hash with commands.ownerDisplaySecret unset).

1. Identify vulnerable deployment: Confirm the target OpenClaw instance is running a version ≤ 2026.2.21-2 with commands.ownerDisplay set to hash and commands.ownerDisplaySecret left unset in the configuration.
2. Gain access to system prompts: Obtain visibility into system prompts sent by OpenClaw to third-party AI model providers — this could be via a compromised provider account, API traffic interception (e.g., man-in-the-middle on the model provider API endpoint), or insider access at the provider.
3. Collect hash outputs: Gather multiple owner-ID hash values from the system prompts. Since the same gateway.auth.token is used as the HMAC secret, each hash is derived from this token.
4. Derive the gateway token: Using the collected hash outputs and knowledge of the hashing algorithm, attempt to brute-force or reverse the HMAC secret (the gateway auth token), particularly effective if the token is weak or low-entropy.
5. Authenticate to the gateway: Use the recovered gateway.auth.token to authenticate directly to the OpenClaw gateway, gaining unauthorized access to the gateway and any systems it controls (GitHub Advisory, Fix Commit).

Upgrade OpenClaw to version 2026.2.22 or later, which removes the fallback to gateway.auth.token and instead auto-generates and persists a dedicated commands.ownerDisplaySecret when hash mode is enabled without an explicit secret. As an immediate workaround if patching is not possible, explicitly set commands.ownerDisplaySecret to a unique, high-entropy value in the OpenClaw configuration, separate from gateway.auth.token. Additionally, operators should minimize exposure of system prompts to third-party model providers and audit access controls around prompt data. Rotating the gateway.auth.token is also advisable if the configuration was previously vulnerable (GitHub Advisory, Fix Commit).

The vulnerability was reported by @aether-ai-agent and acknowledged by the OpenClaw maintainer (steipete) in the GitHub Security Advisory. The advisory was rated "Low" severity by the project maintainers, noting no direct plaintext token disclosure and that practical risk is conditional on weak gateway tokens. No significant broader media coverage or notable researcher commentary beyond the advisory and standard CVE aggregator postings has been observed (GitHub Advisory).