CVE-2026-32039 Details

A vulnerability allowing authorization bypass in OpenClaw has been identified in versions prior to 2026.2.22. This issue arises within the toolsBySender group policy matching, where attackers can exploit identifier collisions involving mutable identity values, such as senderName or senderUsername. By forcing these collisions, attackers can bypass sender-authorization policies and gain unauthorized access to elevated tool permissions. The vulnerability is particularly concerning for deployments that use untyped sender keys, as it allows for the exploitation of sender-authorization mechanisms to inherit privileged tool access intended for other users.

Users can update to OpenClaw version 2026.2.22 or later, where this vulnerability has been patched.