Openclaw cli: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions (CVE-2026-32057)
Description
OpenClaw CLI versions up to 2026.2.24 have a trusted-proxy Control UI pairing bypass vulnerability (CVE-2026-32057). This flaw allows a websocket client with a node role to bypass pairing by setting client.id to 'control-ui', enabling unauthorized access to node event methods. The issue arises because the bypass did not require the operator role, weakening the authorization boundary. The vulnerability is patched in version 2026.2.25 by enforcing the operator role requirement for this bypass.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-32057 describes a trusted-proxy Control UI pairing bypass in OpenClaw CLI where a websocket client with a node role can connect unpaired by using client.id=control-ui. This bypass did not require the operator role, allowing unauthorized node event execution. The vulnerability affects OpenClaw CLI versions from 2026.1.29 up to and including 2026.2.24. The fix, committed in ec45c317f5d0631a3d333b236da58c4749ede2a3 and released in version 2026.2.25, requires the role to be operator to prevent this bypass.
Potential Impact
An authenticated websocket client with the node role can bypass pairing and gain unauthorized access to node event execution flows, resulting in an authorization boundary bypass. This could lead to unauthorized actions within the node event context, potentially impacting integrity of node operations. Confidentiality impact is low, integrity impact is high, and availability is not affected.
Mitigation Recommendations
A patch is available and should be applied. Upgrade OpenClaw CLI to version 2026.2.25 or later, which enforces the operator role requirement for the trusted-proxy Control UI pairing, preventing the bypass.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32057
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245b912601ec6a3166bd4
Added to database: 10/04/2026, 12:25:29 UTC
Last enriched: 10/04/2026, 13:02:10 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.