Vulnerability Report

CVE-2026-32899

Title: Sender-Policy Bypass in OpenClaw

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-32899.

CWE Category CWE-863

Published Date Mar 21, 2026

Modified Date Mar 24, 2026

Exploit Status Not Found

Score 5.3 CVSS v4.0

Exploit Probability (EPSS)

0.20%

Vulnerability Summary

CVE-2026-32899: OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.

Impacted Vendors

openclaw 1

Reference Links

https://github.com/openclaw/openclaw/commit/75dfb71e4e8b7c2feba5a8ca662f92ea840e0147 https://github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j https://www.vulncheck.com/advisories/openclaw-sender-policy-bypass-in-slack-reaction-and-pin-event-handlers

CVSS v4.0

Source Entity [email protected]

Severity MEDIUM

5.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-32899 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

March 24, 2026 MODIFIED

Vulnerability data updated via NVD.

March 24, 2026 MODIFIED

Vulnerability data updated via NVD.

March 23, 2026 MODIFIED

Vulnerability data updated via NVD.

March 21, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.