CVE-2026-32924: Openclaw

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.

Affected products

• Openclaw Openclaw: before 2026.3.12 (fixed in 2026.3.12)

Published 2026-03-29. Last modified 2026-06-17.