CVE-2026-32039 OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender keys by forcing collisions with mutab...

CVE-2026-32039

CVE-2026-32039 affects OpenClaw prior to version 2026.2.22. A vulnerability in the toolsBySender group policy matching allows attackers to bypass sender authorization by causing identity collisions on untyped sender keys with mutable values (e.g., senderName or senderUsername), granting unauthori...