CVE-2026-32897: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
(updated )
- Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
- Hash outputs are visible to third-party model providers in system prompts.
- No direct plaintext token disclosure.
- Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.
References
- github.com/advisories/GHSA-v6x2-2qvm-6gv8
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/c99e7696e6893083b256f0a6c88fb060f3a76fb7
- github.com/openclaw/openclaw/security/advisories/GHSA-v6x2-2qvm-6gv8
- nvd.nist.gov/vuln/detail/CVE-2026-32897
- www.vulncheck.com/advisories/openclaw-authentication-token-reuse-in-owner-id-prompt-hashing-fallback
Code Behaviors & Features
Detect and mitigate CVE-2026-32897 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →