CVE-2026-32059
highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.004 · 31. PerzentilDEEUUSEPSS · bewertet 2026-10-27
OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.3–9.9
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-0490OpenClaw: Mehrere SchwachstellenDeutsch2026-02-23csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher bezeichnete Angriffe durchzuführen.
- WID-SEC-W-2026-0551OpenClaw: Mehrere SchwachstellenDeutsch2026-02-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher spezifizierte Angriffe durchzuführen.
- GHSA-3c6h-g97w-fg78OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode2026-03-03ghsa · osvUS
### Summary In OpenClaw, `tools.exec.safeBins` validation for `sort` could be bypassed via GNU long-option abbreviations in allowlist mode, allowing approval-free execution paths that should require approval. ### Affected Packages / Versions - Ecosystem: npm - Package: `openclaw` - Latest published version checked: `2026.2.22-2` - Affected range: `<= 2026.2.22-2` - Fixed version: `2026.2.23` ### Impact When all of the following are true: - `tools.exec.security=allowlist` - `tools.exec.ask=on-miss` - `tools.exec.safeBins` includes `sort` abbreviated GNU long options (for example `--compress-prog`) could bypass denied-flag checks and be treated as allowlist-satisfied safe-bin usage, skipping approval. ### Root Cause Long-option handling matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed. ### Fix Commit(s) - `3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f` ### Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
- GHSA-7977-c43c-xpwjOpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode2026-02-27ghsa · osvUS
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
- CVE-2026-283632026-02-27vendor · osvUS
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6fcnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78cnnvd
- https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-sort-long-option-abbreviation-in-toolsexecsafebinscnnvd
- https://github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6fenisa_euvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78enisa_euvd
- https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-sort-long-option-abbreviation-in-toolsexecsafebinsenisa_euvd
- https://github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6fPatchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan