{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32021"],"ecosystem":"npm","epss":0.00213,"exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-j4xf-96qf-rx69","id":"tcs_01M5KFWZBNVJKY8WQC3JNP8T8M","modified_at":"2026-03-30T13:33:53.160138Z","published_at":"2026-03-03T21:41:38Z","references":["https://osv.dev/vulnerability/GHSA-j4xf-96qf-rx69","https://github.com/openclaw/openclaw/security/advisories/GHSA-j4xf-96qf-rx69","https://nvd.nist.gov/vuln/detail/CVE-2026-32021","https://github.com/openclaw/openclaw/commit/4ed87a667263ed2d422b9d5d5a5d326e099f92c7","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-display-name-collision-in-feishu-allowfrom"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-j4xf-96qf-rx69","url":"https://osv.dev/vulnerability/GHSA-j4xf-96qf-rx69"}],"summary":"OpenClaw has a Feishu allowFrom authorization bypass via display-name collision"}