CVE-2026-32975 — OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser…¶

Key facts

CVE-2026-32975 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32975
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32975/

Details¶

CVE-2026-32975 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32975
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32975/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32975

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/security/advisories/GHSA-f5mf-3r52-r83w
https://www.vulncheck.com/advisories/openclaw-weak-authorization-via-mutable-group-names-in-zalouser-allowlist

Generated by PoC Generator on 2026-04-10T15:59:15.254565961

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32975, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32975 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32975 OpenClaw weak authorization bypass attempt"; content:"Zalouser"; nocase; content:"allowlist"; nocase; distance:0; within:100; content:"group"; nocase; distance:0; within:50; pcre:"/display[_\s]*name/i"; classtype:policy-violation; sid:1000000; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32975 OpenClaw group name spoofing attack"; content:"create"; nocase; content:"group"; nocase; distance:0; within:20; content:"name"; nocase; distance:0; within:30; pcre:"/identical|duplicate|same/i"; classtype:attempted-admin; sid:1000001; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32975 OpenClaw channel authorization bypass"; content:"channel"; nocase; content:"authorization"; nocase; distance:0; within:50; content:"bypass"; nocase; distance:0; within:30; classtype:policy-violation; sid:1000002; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32975 OpenClaw message routing manipulation"; content:"route"; nocase; content:"message"; nocase; distance:0; within:30; content:"unintended"; nocase; distance:0; within:50; content:"group"; nocase; distance:0; within:20; classtype:attempted-admin; sid:1000003; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32975 OpenClaw group identifier manipulation"; content:"group"; nocase; content:"identifier"; nocase; distance:0; within:30; content:"mutable"; nocase; distance:0; within:50; classtype:policy-violation; sid:1000004; rev:1; priority:2;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32975_OpenClaw_Weak_Authorization_Exploit {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation attempts for CVE-2026-32975 - OpenClaw weak authorization vulnerability"
        cve = "CVE-2026-32975"
        date = "2024"
        severity = "medium"

    strings:
        $openclaw_config1 = "Zalouser" nocase
        $openclaw_config2 = "allowlist" nocase
        $openclaw_config3 = "group_display_name" nocase
        $openclaw_config4 = "group_identifier" nocase

        $exploit_pattern1 = /group.*name.*[\"\']([^\"\']+)[\"\'].*allowlist/i
        $exploit_pattern2 = /create.*group.*[\"\']([^\"\']+)[\"\'].*bypass/i
        $exploit_pattern3 = /duplicate.*group.*name.*authorization/i

        $openclaw_binary = "openclaw" nocase
        $openclaw_service = "OpenClaw" nocase

        $suspicious_group1 = "admin" nocase
        $suspicious_group2 = "administrator" nocase
        $suspicious_group3 = "privileged" nocase
        $suspicious_group4 = "system" nocase

        $config_manipulation = /group\s*=\s*[\"\']([^\"\']+)[\"\']/
        $channel_routing = "route_message" nocase
        $agent_connection = "agent" nocase

        $hex_pattern1 = { 5A 61 6C 6F 75 73 65 72 } // "Zalouser"
        $hex_pattern2 = { 61 6C 6C 6F 77 6C 69 73 74 } // "allowlist"

    condition:
        (
            ($openclaw_binary or $openclaw_service) and
            ($openclaw_config1 or $openclaw_config2) and
            (
                any of ($exploit_pattern*) or
                ($config_manipulation and $channel_routing) or
                (2 of ($suspicious_group*) and $agent_connection)
            )
        ) or
        (
            any of ($hex_pattern*) and
            ($exploit_pattern1 or $exploit_pattern2)
        )
}

rule CVE_2026_32975_OpenClaw_Config_Abuse {
    meta:
        author = "Security Engineer"
        description = "Detects configuration abuse related to CVE-2026-32975"
        cve = "CVE-2026-32975"
        date = "2024"
        severity = "medium"

    strings:
        $config_file1 = "openclaw.conf" nocase
        $config_file2 = "openclaw.yaml" nocase
        $config_file3 = "openclaw.json" nocase

        $group_creation = /CREATE\s+GROUP\s+[\"\']([^\"\']+)[\"\']/i
        $group_modification = /ALTER\s+GROUP\s+[\"\']([^\"\']+)[\"\']/i
        $group_duplicate = /INSERT.*GROUP.*name.*[\"\']([^\"\']+)[\"\']/i

        $version_vulnerable = "OpenClaw" nocase
        $version_check = /version.*2026\.[0-2]\.|version.*2026\.3\.[0-9]|version.*2026\.3\.1[01]/

        $authorization_bypass = "authorization_bypass" nocase
        $group_spoof = "group_spoof" nocase
        $display_name_abuse = "display_name" nocase

    condition:
        (
            any of ($config_file*) and
            (
                any of ($group_creation, $group_modification, $group_duplicate) or
                ($authorization_bypass or $group_spoof)
            )
        ) or
        (
            $version_vulnerable and
            $version_check and
            $display_name_abuse
        )
}

rule CVE_2026_32975_OpenClaw_Memory_Indicators {
    meta:
        author = "Security Engineer"
        description = "Detects memory-based indicators for CVE-2026-32975 exploitation"
        cve = "CVE-2026-32975"
        date = "2024"
        severity = "medium"

    strings:
        $mem_string1 = "zalouser_allowlist_check" nocase
        $mem_string2 = "group_display_name_match" nocase
        $mem_string3 = "bypass_channel_auth" nocase
        $mem_string4 = "duplicate_group_creation" nocase

        $function_call1 = "validateGroupAccess" nocase
        $function_call2 = "checkAllowlist" nocase
        $function_call3 = "routeMessage" nocase

        $exploit_marker = { 45 58 50 4C 4F 49 54 5F 47 52 4F 55 50 } // "EXPLOIT_GROUP"
        $bypass_marker = { 42 59 50 41 53 53 5F 41 55 54 48 } // "BYPASS_AUTH"

    condition:
        (
            2 of ($mem_string*) and
            any of ($function_call*)
        ) or
        any of ($exploit_marker, $bypass_marker)
}

:material-file-download: prevention/yara.yar

# CVE-2026-32975: OpenClaw Weak Authorization Prevention Rules
# Block requests attempting to exploit weak authorization in Zalouser allowlist mode

# Block requests with suspicious group manipulation patterns
location ~* /api/groups {
    # Block requests with duplicate or suspicious group names
    if ($request_body ~* "displayName.*displayName") {
        return 403 "Forbidden: Duplicate group name manipulation detected";
    }

    # Block requests attempting to create groups with common allowlist bypass patterns
    if ($request_body ~* "(admin|administrator|root|system|allowed|whitelist|allowlist)") {
        return 403 "Forbidden: Suspicious group name creation attempt";
    }

    # Block requests with excessive special characters in group names
    if ($request_body ~* "displayName.*[!@#$%^&*()_+=\[\]{}|;':\",./<>?~`]{3,}") {
        return 403 "Forbidden: Invalid characters in group name";
    }
}

# Block OpenClaw authorization bypass attempts
location ~* /api/(auth|authorization|channel|route) {
    # Block requests attempting to manipulate group identifiers
    if ($request_body ~* "(groupId|group_id).*null") {
        return 403 "Forbidden: Group identifier manipulation attempt";
    }

    # Block requests with mismatched group display names and IDs
    if ($request_body ~* "displayName.*[\"'][^\"']*[\"'].*groupId.*[\"'][^\"']*[\"']") {
        if ($request_body ~* "displayName.*[\"']([^\"']*)[\"'].*groupId.*[\"'](?!\1)[^\"']*[\"']") {
            return 403 "Forbidden: Group name/ID mismatch detected";
        }
    }

    # Block requests attempting to bypass channel authorization
    if ($request_body ~* "(bypass|override|skip).*auth") {
        return 403 "Forbidden: Authorization bypass attempt";
    }
}

# Block Zalouser specific exploitation attempts
location ~* /zalouser {
    # Block requests manipulating allowlist mode
    if ($args ~* "(allowlist|whitelist).*mode") {
        return 403 "Forbidden: Allowlist mode manipulation";
    }

    # Block requests with suspicious group routing patterns
    if ($request_body ~* "route.*group.*(?:displayName|name).*(?:admin|system|root)") {
        return 403 "Forbidden: Suspicious group routing attempt";
    }
}

# Block message routing manipulation
location ~* /api/messages {
    # Block requests attempting to route messages using display names instead of stable IDs
    if ($request_body ~* "route.*displayName") {
        return 403 "Forbidden: Message routing using display name detected";
    }

    # Block requests with suspicious agent routing
    if ($request_body ~* "agent.*group.*displayName") {
        return 403 "Forbidden: Suspicious agent routing attempt";
    }
}

# General OpenClaw security headers and restrictions
location ~* /api/ {
    # Ensure proper content type for API requests
    if ($content_type !~* "application/json") {
        if ($request_method != "GET") {
            return 415 "Unsupported Media Type";
        }
    }

    # Block requests with excessively long group names
    if ($request_body ~* "displayName.*[\"'][^\"']{100,}[\"']") {
        return 413 "Request Entity Too Large";
    }

    # Rate limiting for group creation attempts
    limit_req zone=group_creation burst=5 nodelay;

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
}

# Rate limiting zone definition (place in http block)
# limit_req_zone $binary_remote_addr zone=group_creation:10m rate=10r/m;

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32975 - OpenClaw weak authorization vulnerability
# Protects against group name spoofing attacks in Zalouser allowlist mode

# Rule 1000001: Detect OpenClaw API endpoints
SecRule REQUEST_URI "@contains /api/zalouser" \
    "id:1000001,\
    phase:1,\
    block,\
    msg:'OpenClaw Zalouser API endpoint detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'NOTICE',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-injection',\
    tag:'CVE-2026-32975',\
    chain"
    SecRule ARGS "@detectSQLi" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:normalisePathWin,\
        msg:'OpenClaw Zalouser API access attempt',\
        severity:'CRITICAL'"

# Rule 1000002: Block duplicate group name creation attempts
SecRule REQUEST_URI "@rx /api/(groups?|channels?)/create" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'OpenClaw group creation attempt detected',\
    logdata:'URI: %{REQUEST_URI}, Method: %{REQUEST_METHOD}',\
    severity:'WARNING',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-bypass',\
    tag:'CVE-2026-32975',\
    chain"
    SecRule REQUEST_BODY "@rx (?i)(group[_\s]*name|display[_\s]*name|channel[_\s]*name)" \
        "t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,\
        msg:'Group name parameter detected in creation request',\
        severity:'CRITICAL'"

# Rule 1000003: Detect suspicious group identifier manipulation
SecRule ARGS_NAMES "@rx (?i)(group[_\s]*id|channel[_\s]*id|identifier)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'OpenClaw group identifier manipulation attempt',\
    logdata:'Parameter: %{MATCHED_VAR_NAME}, Value: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-bypass',\
    tag:'CVE-2026-32975',\
    chain"
    SecRule ARGS "@rx [^a-zA-Z0-9\-_]" \
        "t:urlDecodeUni,t:htmlEntityDecode,\
        msg:'Suspicious characters in group identifier',\
        severity:'CRITICAL'"

# Rule 1000004: Block authorization bypass attempts via group name spoofing
SecRule REQUEST_BODY "@rx (?i)(allowlist|whitelist|authorized[_\s]*groups?)" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'OpenClaw allowlist manipulation attempt detected',\
    logdata:'Body contains: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-bypass',\
    tag:'CVE-2026-32975'"

# Rule 1000005: Detect multiple rapid group creation requests
SecRule IP:GROUP_CREATE_COUNTER "@gt 3" \
    "id:1000005,\
    phase:1,\
    block,\
    msg:'OpenClaw rapid group creation detected - potential spoofing attack',\
    logdata:'Client IP: %{REMOTE_ADDR}, Counter: %{IP.GROUP_CREATE_COUNTER}',\
    severity:'WARNING',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-dos',\
    tag:'CVE-2026-32975',\
    expirevar:IP.GROUP_CREATE_COUNTER=300"

SecRule REQUEST_URI "@rx /api/(groups?|channels?)/create" \
    "id:1000006,\
    phase:1,\
    pass,\
    nolog,\
    setvar:IP.GROUP_CREATE_COUNTER=+1"

# Rule 1000007: Block requests with suspicious Unicode characters in group names
SecRule ARGS "@rx (?i)(group[_\s]*name|display[_\s]*name)" \
    "id:1000007,\
    phase:2,\
    block,\
    msg:'OpenClaw Unicode spoofing attempt in group name',\
    logdata:'Parameter: %{MATCHED_VAR_NAME}, Value: %{MATCHED_VAR}',\
    severity:'HIGH',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-bypass',\
    tag:'CVE-2026-32975',\
    chain"
    SecRule ARGS "@rx [\u00A0\u1680\u180E\u2000-\u200B\u202F\u205F\u3000\uFEFF]" \
        "t:urlDecodeUni,t:htmlEntityDecode,\
        msg:'Suspicious Unicode whitespace characters detected',\
        severity:'HIGH'"

# Rule 1000008: Block OpenClaw message routing manipulation
SecRule REQUEST_URI "@rx /api/(messages?|routing|channels?/route)" \
    "id:1000008,\
    phase:2,\
    block,\
    msg:'OpenClaw message routing request detected',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:'WARNING',\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'attack-bypass',\
    tag:'CVE-2026-32975',\
    chain"
    SecRule REQUEST_BODY "@rx (?i)(source[_\s]*group|target[_\s]*group|route[_\s]*to)" \
        "t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,\
        msg:'Message routing parameters detected',\
        severity:'CRITICAL'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32975?¶

CVE-2026-32975 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32975?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32975?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.