CVE-2026-32014: Openclaw

High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect metadata to bypass platform-based node command policies and gain access to restricted commands.

Affected products

• Openclaw Openclaw: before 2026.2.26 (fixed in 2026.2.26)

Published 2026-03-19. Last modified 2026-06-17.