CVE-2026-32916 is a critical authorization bypass in OpenClaw, scored CVSS 9.4 by NVD. Plugin subagent routes ran gateway methods through a synthetic operator client with broad admin scopes. OpenClaw 2026.3.7 up to before 2026.3.11 is affected, so upgrade to 2026.3.11.
What's affected
The NVD record and the GitHub advisory agree: OpenClaw from 2026.3.7 up to but not including 2026.3.11 is affected, and 2026.3.11 is the fixed version. The package is openclaw on npm.
The advisory says it did not find a shipped extension in the repository that used the affected call on a public plugin route. The issue mainly affects custom or third party plugins that combine plugin managed public routes with runtime.subagent calls. The advisory scores it High at 7.7; NVD scores it 9.4.
How to check if you're exposed
Check the installed version:
npm ls openclaw
If it is between 2026.3.7 and 2026.3.10, you are in the range. Then search your own and third party plugins for the risky combination:
grep -rn "runtime.subagent" plugins/ node_modules/ --include=*.js --include=*.ts
A hit on a plugin route that uses plugin managed authentication and is reachable without a gateway login deserves a close read.
What to do now
- Upgrade OpenClaw to 2026.3.11 or later.
- If you cannot upgrade yet, stop calling runtime.subagent methods from plugin owned public routes unless the route performs its own strict authentication and authorization, as the advisory advises.
- Review plugins you installed from third parties for public routes.
- Check gateway logs for session deletions or agent runs you did not start.
Why it matters
The class is CWE-266, incorrect privilege assignment. The advisory says the subagent runtime did not carry the real caller's identity or a least privilege scope. It built a stand-in operator client holding administrative scopes. Public plugin routes are meant to be reachable for webhooks, so an unauthenticated request could end up with admin power.
The fix passes the real gateway client into the runtime and caps unauthenticated plugin route access at a non-admin scope. The record's KEV flag is false.
Quick check
Do bundled extensions trigger this?
The advisory says it found no shipped extension route using the affected call. Custom and third party plugins are the main concern.
Sources
Last reviewed: 19 October 2026.
