CVE-2026-32916 — OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability…¶

Key facts

CVE-2026-32916 is a Critical (9.4) vulnerability: OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32916
Severity	Critical (9.4)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32916/

Details¶

CVE-2026-32916 is a Critical (9.4) vulnerability: OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32916
CVSS Score	9.4

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32916/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32916

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-plugin-subagent-routes-via-synthetic-admin-scopes

Generated by PoC Generator on 2026-04-10T15:48:20.089922145

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32916, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32916 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32916 OpenClaw Authorization Bypass - Plugin Subagent Route Access"; flow:established,to_server; content:"plugin"; http_uri; content:"subagent"; http_uri; distance:0; within:50; content:"runtime"; http_uri; distance:0; within:100; pcre:"/\/plugin.*\/subagent.*runtime/i"; classtype:web-application-attack; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32916 OpenClaw Authorization Bypass - Session Deletion via Subagent"; flow:established,to_server; content:"POST"; http_method; content:"subagent"; http_uri; content:"session"; http_uri; content:"delete"; http_uri; distance:0; within:20; classtype:web-application-attack; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32916 OpenClaw Authorization Bypass - Agent Execution via Subagent"; flow:established,to_server; content:"subagent"; http_uri; content:"agent"; http_uri; distance:0; within:50; content:"execute"; http_uri; distance:0; within:30; classtype:web-application-attack; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32916 OpenClaw Authorization Bypass - Gateway Method Invocation"; flow:established,to_server; content:"gateway"; http_uri; content:"method"; http_uri; distance:0; within:30; content:"synthetic"; http_header; classtype:web-application-attack; sid:1000003; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32916 OpenClaw Authorization Bypass - Runtime Subagent Method Call"; flow:established,to_server; content:"runtime.subagent"; http_uri; pcre:"/runtime\.subagent\.(delete|execute|invoke)/i"; classtype:web-application-attack; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32916_OpenClaw_AuthBypass_Exploitation {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw CVE-2026-32916 authorization bypass exploitation attempts"
        cve = "CVE-2026-32916"
        severity = "high"
        date = "2024-12-19"

    strings:
        $version_vulnerable1 = "OpenClaw 2026.3.7"
        $version_vulnerable2 = "OpenClaw 2026.3.8"
        $version_vulnerable3 = "OpenClaw 2026.3.9"
        $version_vulnerable4 = "OpenClaw 2026.3.10"

        $subagent_call1 = "runtime.subagent"
        $subagent_call2 = "plugin.subagent"
        $subagent_call3 = "subagent.execute"

        $gateway_method1 = "gateway.deleteSession"
        $gateway_method2 = "gateway.executeAgent"
        $gateway_method3 = "gateway.adminAction"

        $synthetic_client1 = "synthetic_operator_client"
        $synthetic_client2 = "syntheticOperator"
        $synthetic_client3 = "synthetic-operator"

        $plugin_route1 = "/plugin/"
        $plugin_route2 = "plugin-owned-route"
        $plugin_route3 = "/api/plugin/"

        $bypass_indicator1 = "unauthenticated_request"
        $bypass_indicator2 = "bypass_authorization"
        $bypass_indicator3 = "admin_scope_escalation"

        $exploit_pattern1 = { 70 6C 75 67 69 6E [0-20] 73 75 62 61 67 65 6E 74 [0-20] 67 61 74 65 77 61 79 }
        $exploit_pattern2 = { 72 75 6E 74 69 6D 65 2E 73 75 62 61 67 65 6E 74 [0-30] 61 64 6D 69 6E }

    condition:
        any of ($version_vulnerable*) or
        (
            any of ($subagent_call*) and 
            any of ($gateway_method*) and 
            any of ($synthetic_client*)
        ) or
        (
            any of ($plugin_route*) and 
            any of ($bypass_indicator*)
        ) or
        any of ($exploit_pattern*)
}

rule CVE_2026_32916_OpenClaw_Malicious_Payload {
    meta:
        author = "Security Engineer"
        description = "Detects malicious payloads targeting OpenClaw CVE-2026-32916"
        cve = "CVE-2026-32916"
        severity = "critical"
        date = "2024-12-19"

    strings:
        $payload1 = "POST /plugin/" ascii
        $payload2 = "runtime.subagent.invoke" ascii
        $payload3 = "deleteSession" ascii
        $payload4 = "executeAgent" ascii

        $http_exploit1 = "User-Agent: OpenClawExploit" ascii
        $http_exploit2 = "X-Plugin-Route: bypass" ascii
        $http_exploit3 = "Authorization: None" ascii

        $json_payload1 = "\"method\":\"runtime.subagent\"" ascii
        $json_payload2 = "\"scope\":\"admin\"" ascii
        $json_payload3 = "\"synthetic\":true" ascii

        $hex_signature1 = { 4F 70 65 6E 43 6C 61 77 [0-10] 32 30 32 36 2E 33 2E [37-39] }
        $hex_signature2 = { 73 75 62 61 67 65 6E 74 [0-20] 67 61 74 65 77 61 79 [0-20] 62 79 70 61 73 73 }

    condition:
        2 of ($payload*) or
        any of ($http_exploit*) or
        2 of ($json_payload*) or
        any of ($hex_signature*)
}

rule CVE_2026_32916_OpenClaw_Network_Indicators {
    meta:
        author = "Security Engineer"
        description = "Detects network-based indicators for OpenClaw CVE-2026-32916 exploitation"
        cve = "CVE-2026-32916"
        severity = "medium"
        date = "2024-12-19"

    strings:
        $url_pattern1 = /\/plugin\/[a-zA-Z0-9_-]+\/subagent/ ascii
        $url_pattern2 = /\/api\/plugin\/.*runtime\.subagent/ ascii
        $url_pattern3 = /\/gateway\/admin\/.*synthetic/ ascii

        $request_header1 = "X-Subagent-Method:" ascii
        $request_header2 = "X-Gateway-Bypass:" ascii
        $request_header3 = "X-Synthetic-Client:" ascii

        $response_leak1 = "admin_session_deleted" ascii
        $response_leak2 = "agent_execution_success" ascii
        $response_leak3 = "synthetic_operator_authenticated" ascii

        $log_entry1 = "[EXPLOIT] CVE-2026-32916" ascii
        $log_entry2 = "OpenClaw authorization bypass" ascii
        $log_entry3 = "subagent privilege escalation" ascii

    condition:
        any of ($url_pattern*) or
        any of ($request_header*) or
        any of ($response_leak*) or
        any of ($log_entry*)
}

:material-file-download: prevention/yara.yar

# Block unauthorized access to plugin subagent routes
location ~* ^/(?:api/)?(?:plugin|subagent|gateway)/ {
    # Block direct access to subagent methods
    if ($request_uri ~* "(?:runtime\.subagent|subagent\.runtime)") {
        return 403;
    }

    # Block synthetic operator client invocations
    if ($request_uri ~* "synthetic[_-]?operator") {
        return 403;
    }

    # Block privileged gateway method calls
    if ($request_uri ~* "(?:session[_-]?delete|agent[_-]?execution|execute[_-]?agent)") {
        return 403;
    }

    # Require authentication for plugin routes
    if ($http_authorization = "") {
        return 401;
    }

    # Block requests with suspicious user agents
    if ($http_user_agent ~* "(?:curl|wget|python|perl|ruby)") {
        return 403;
    }
}

# Block direct runtime subagent access patterns
location ~* "runtime\.subagent|subagent\.runtime" {
    return 403;
}

# Block synthetic operator client patterns
location ~* "synthetic[_-]?operator" {
    return 403;
}

# Enhanced protection for gateway endpoints
location ~* ^/(?:api/)?gateway/ {
    # Block unauthenticated requests
    if ($http_authorization = "") {
        return 401;
    }

    # Block administrative scope operations
    if ($request_uri ~* "(?:admin|privileged|elevated|scope|broad)") {
        return 403;
    }

    # Rate limiting for gateway endpoints
    limit_req zone=gateway_limit burst=5 nodelay;
}

# Block malicious query parameters
location / {
    if ($args ~* "(?:runtime\.subagent|subagent\.runtime|synthetic[_-]?operator)") {
        return 403;
    }

    if ($args ~* "(?:session[_-]?delete|agent[_-]?execution|execute[_-]?agent)") {
        return 403;
    }
}

# Security headers for OpenClaw protection
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-OpenClaw-Protection "CVE-2026-32916-blocked" always;

# Rate limiting zone definition (place in http block)
limit_req_zone $binary_remote_addr zone=gateway_limit:10m rate=10r/m;

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32916 - OpenClaw Authorization Bypass
# Protects against unauthorized access to plugin subagent routes and gateway methods

# Block requests to plugin subagent routes from unauthenticated users
SecRule REQUEST_URI "@rx /plugin[s]?/.*/(subagent|gateway)" \
    "id:1000001,\
    phase:1,\
    block,\
    severity:'CRITICAL',\
    msg:'CVE-2026-32916: Blocked unauthenticated access to plugin subagent routes',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    tag:'cve-2026-32916',\
    tag:'authorization-bypass'"

# Block requests containing runtime.subagent method calls
SecRule ARGS "@rx runtime\.subagent" \
    "id:1000002,\
    phase:2,\
    block,\
    severity:'CRITICAL',\
    msg:'CVE-2026-32916: Blocked runtime.subagent method invocation attempt',\
    logdata:'Matched argument: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
    tag:'cve-2026-32916',\
    tag:'method-invocation'"

# Block POST/PUT requests to subagent endpoints without proper authentication
SecRule REQUEST_METHOD "@rx ^(POST|PUT)$" \
    "id:1000003,\
    phase:1,\
    chain,\
    severity:'HIGH',\
    msg:'CVE-2026-32916: Blocked unauthenticated POST/PUT to subagent endpoint'"
    SecRule REQUEST_URI "@rx /subagent" \
        "chain"
    SecRule &REQUEST_HEADERS:Authorization "@eq 0" \
        "block,\
        logdata:'Method: %{REQUEST_METHOD}, URI: %{REQUEST_URI}',\
        tag:'cve-2026-32916',\
        tag:'unauthenticated-write'"

# Block requests attempting session deletion through subagent
SecRule ARGS "@rx (session|sess).*delete" \
    "id:1000004,\
    phase:2,\
    block,\
    severity:'HIGH',\
    msg:'CVE-2026-32916: Blocked session deletion attempt via subagent',\
    logdata:'Matched parameter: %{MATCHED_VAR_NAME}',\
    tag:'cve-2026-32916',\
    tag:'session-manipulation'"

# Block requests attempting agent execution through subagent
SecRule ARGS "@rx (agent|execute|exec|run)" \
    "id:1000005,\
    phase:2,\
    chain,\
    severity:'CRITICAL',\
    msg:'CVE-2026-32916: Blocked agent execution attempt via subagent'"
    SecRule REQUEST_URI "@rx /plugin[s]?/.*subagent" \
        "block,\
        logdata:'URI: %{REQUEST_URI}, Suspicious parameter: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
        tag:'cve-2026-32916',\
        tag:'agent-execution'"

# Block requests with synthetic operator client indicators
SecRule REQUEST_HEADERS "@rx synthetic.operator" \
    "id:1000006,\
    phase:1,\
    block,\
    severity:'HIGH',\
    msg:'CVE-2026-32916: Blocked request with synthetic operator client header',\
    logdata:'Header: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
    tag:'cve-2026-32916',\
    tag:'synthetic-operator'"

# Block requests to gateway methods from plugin routes
SecRule REQUEST_URI "@rx /plugin[s]?/.*gateway" \
    "id:1000007,\
    phase:1,\
    chain,\
    severity:'HIGH',\
    msg:'CVE-2026-32916: Blocked access to gateway methods from plugin route'"
    SecRule ARGS "@rx (admin|execute|delete|modify|create)" \
        "block,\
        logdata:'Gateway method access attempt: %{REQUEST_URI}',\
        tag:'cve-2026-32916',\
        tag:'gateway-abuse'"

# Rate limiting for plugin subagent endpoints
SecRule REQUEST_URI "@rx /plugin[s]?/.*subagent" \
    "id:1000008,\
    phase:1,\
    pass,\
    nolog,\
    setvar:'ip.plugin_subagent_counter=+1',\
    expirevar:'ip.plugin_subagent_counter=60'"

SecRule IP:PLUGIN_SUBAGENT_COUNTER "@gt 5" \
    "id:1000009,\
    phase:1,\
    block,\
    severity:'MEDIUM',\
    msg:'CVE-2026-32916: Rate limit exceeded for plugin subagent endpoints',\
    logdata:'Requests: %{IP.PLUGIN_SUBAGENT_COUNTER}, IP: %{REMOTE_ADDR}',\
    tag:'cve-2026-32916',\
    tag:'rate-limiting'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32916?¶

CVE-2026-32916 is a Critical (9.4) vulnerability: OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32916?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32916?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.