CVE-2026-32897

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Key Management Errors pada openclaw. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.

Rincian

Terbit di NVD

21 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-320: Key Management Errors

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-v6x2-2qvm-6gv8 mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/c99e7696e6893083b256f0a6c88fb060f3a76fb7 patch
• https://www.vulncheck.com/advisories/openclaw-authentication-token-reuse-in-owner-id-prompt-hashing-fallback advisory pihak ketiga