sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-32897 OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback

Medium 6.3 Published Updated

Attackers can derive gateway authentication tokens from hashed owner IDs if specific display settings are enabled, compromising authentication security.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-32897?

CVE-2026-32897 is a medium-severity vulnerability in Openclaw Openclaw, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.

Weakness: CWE-320

Which versions are affected by CVE-2026-32897?

2 open source packages ship an affected version, including openclaw. It affects 1 product.

PackageAffectedFixed in
openclaw npmAll versions2026.2.22
openclaw npmAll versions2026.2.22

Products include Openclaw Openclaw.

How do I fix CVE-2026-32897?

Upgrade openclaw to 2026.2.22 or later.

Is CVE-2026-32897 being exploited?

There is no known exploitation of CVE-2026-32897 in the wild and no public exploit code.

All Openclaw Openclaw vulnerabilities

Sources

Also known as GHSA-v6x2-2qvm-6gv8, MINI-6q2j-cxrx-3226.

Is CVE-2026-32897 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free