Openclaw cli: OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass (CVE-2026-32039)
Description
OpenClaw CLI versions up to 2026.2.21-2 have a sender-authorization bypass vulnerability in the toolsBySender group policy matching when using untyped keys. This flaw allows an attacker to gain stronger tool permissions by causing an identifier collision with another sender's identity. The issue is fixed by introducing explicit typed sender keys and deprecating untyped keys. A patch is planned for version 2026.2.22.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in OpenClaw CLI affects the channels.*.groups.*.toolsBySender configuration, where untyped sender keys (such as senderName or senderUsername) could collide, allowing an attacker to bypass identity-collision policies. This bypass enables unauthorized inheritance of privileged tool permissions intended for another sender. The fix involves adding explicit typed sender keys (id:, e164:, username:, name:) and maintaining legacy untyped keys only on a deprecated path, preventing cross-identifier collisions. The vulnerability is tracked as CVE-2026-32039 with a CVSS 3.1 score of 5.9.
Potential Impact
An attacker exploiting this vulnerability can bypass sender-authorization policies by causing collisions in untyped sender keys, thereby inheriting stronger tool permissions than authorized. This could lead to unauthorized actions within group tool policies, impacting integrity and confidentiality of operations controlled by OpenClaw CLI.
Mitigation Recommendations
A patch is available and planned for release in OpenClaw CLI version 2026.2.22. Users should upgrade to this version once published to remediate the vulnerability. Until then, deployments using untyped keys in toolsBySender are vulnerable. No additional vendor mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32039
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245bb12601ec6a3166be2
Added to database: 10/04/2026, 12:25:31 UTC
Last enriched: 10/04/2026, 13:03:36 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.