要点
- CVE-2026-32035 是影响 openclaw (openclaw), openclaw 的高危 (CVSS 7.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.14%，高于 3.7% 的漏洞。
- 修复：升级到 2026.3.2 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.2
| 2026.3.2
|
| openclaw npm | < 2026.3.2
| 2026.3.2
|
Description
Summary
In [email protected], the Discord voice transcript path called agentCommand(...) without senderIsOwner, and agentCommand defaults missing senderIsOwner to true.
This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (gateway, cron) during voice transcript turns.
Security model note
OpenClaw’s documented trust model is a personal assistant model (one trusted operator), not an adversarial multi-user boundary.
- OpenClaw does not treat one shared gateway/chat surface as a hardened per-user auth boundary.
- Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.
This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.
Details
Relevant path:
- Voice transcript run omitted
senderIsOwner in Discord voice manager.
- Missing
senderIsOwner defaulted to true in agentCommand.
- Owner-only tool policy is keyed on
senderIsOwner.
gateway and cron are owner-only tools.
Impact
- Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants.
- No gateway-auth boundary bypass was required.
- Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).
Severity rationale
Downgraded from high to medium to align with OpenClaw’s trust model and deployment assumptions:
- Requires participation in the same voice environment as the trusted operator workflow.
- Requires Discord voice path conditions (joined voice channel + transcript flow).
- Does not introduce a new cross-gateway or unauthenticated boundary bypass.
Remediation
- Always pass explicit
senderIsOwner from Discord voice transcript ingress.
- Fail closed (
false) when owner status is unknown for non-local/chat ingress paths.
- Keep regression tests that verify owner/non-owner voice speaker handling.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected versions:
<= 2026.3.1
- Patched versions:
>= 2026.3.2 (released)
NVD description
OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron functionality in mixed-trust channels.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free