Security readout for executives and security teams
Plain-English summary
A flaw in OpenClaw lets anyone on the network trigger administrative actions without logging in. Plugin routes internally act as a super-privileged operator, so an outside request can delete sessions or run agents as if an administrator sent it. Any organization running OpenClaw 2026.3.7 through 2026.3.10 with plugin routes reachable should treat this as an urgent patch.
Executive priority
Treat as urgent. This is a critical (CVSS 9.4) unauthenticated privilege bypass in OpenClaw that can let outside requests perform administrative actions. Prioritize patching to 2026.3.11 within the next change window and restrict exposure of plugin routes in the interim.
Technical view
OpenClaw 2026.3.7 up to (but not including) 2026.3.11 routes plugin subagent traffic through a synthetic operator client provisioned with broad administrative scopes. Unauthenticated remote callers reaching plugin-owned routes can invoke runtime.subagent gateway methods, enabling privileged actions such as session deletion and agent execution. CVSS 3.1 is 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Root cause aligns with CWE-266 (Incorrect Privilege Assignment).
Likely exposure
Any OpenClaw deployment on 2026.3.7 through 2026.3.10 where plugin subagent routes are reachable from untrusted networks is exposed. No authentication is required, so internet-facing or shared-tenant instances face the highest risk, and internal instances remain reachable to any authenticated network position.
Exploitation context
The GitHub Security Advisory and VulnCheck advisory describe the flaw as a remote, unauthenticated authorization bypass reachable over the network. CISA KEV does not currently list this CVE, and the source bundle cites no public proof-of-concept or in-the-wild exploitation. Given the low attack complexity and privileged impact, opportunistic scanning is a realistic near-term concern.
Researcher notes
The vulnerability class (CWE-266) reflects a design mistake where plugin subagent execution reuses a synthetic operator identity with unfiltered administrative scopes rather than the caller's authorization context. Investigators should map every plugin-owned route to its gateway invocation path and confirm scope inheritance is fixed after upgrade. The source bundle names no public exploit, so evidence for weaponization is currently absent.
Mitigation direction
- Upgrade OpenClaw to 2026.3.11 or later on all affected instances.
- Restrict network access to plugin subagent routes until patching is verified.
- Review vendor advisory GHSA-xw77-45gv-p728 for any additional configuration guidance.
- Audit gateway logs for unexpected runtime.subagent invocations or session deletions.
- Rotate operator credentials and session tokens if compromise is suspected.
Validation and detection
- Enumerate OpenClaw instances and confirm the running build against 2026.3.11.
- Verify plugin subagent route reachability from untrusted network segments.
- Inspect gateway audit logs for anomalous runtime.subagent calls or admin-scoped actions.
- Confirm post-patch that synthetic operator clients no longer expose broad admin scopes.
- Track advisories GHSA-xw77-45gv-p728 and VulnCheck for updates or KEV escalation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-32916 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L3.95.5VulnCheckCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.4CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-xw77-45gv-p728)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin ScopesCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.