CVE-2026-32065
mediumpriority · track · 26OT risk · elevatedEPSS 0.003 · 22 %ileDEEUUSEPSS · scored 2026-10-27
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to execute a different binary than what the approver displayed, allowing unexpected command execution under the OpenClaw runtime user when they can influence command argv and reuse an approval context.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.9–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0542OpenClaw: Mehrere SchwachstellenDeutsch2026-02-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
- GHSA-hwpq-rrpf-pgcqOpenClaw: system.run approval identity mismatch could execute a different binary than displayed2026-03-02ghsa · osvUS
### Summary `system.run` approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.24` - Patched versions: `>= 2026.2.25` ### Impact This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence `command` argv and reuse/obtain a matching approval context. ### Trust Model Note OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv). ### Fix Commit(s) - `03e689fc89bbecbcd02876a95957ef1ad9caa176` ### Release Process Note `patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`. OpenClaw thanks @tdjackey for reporting.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176cnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcqcnnvd
- https://www.vulncheck.com/advisories/openclaw-approval-identity-mismatch-in-system-run-command-executioncnnvd
- https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176enisa_euvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcqenisa_euvd
- https://www.vulncheck.com/advisories/openclaw-approval-identity-mismatch-in-system-run-command-executionenisa_euvd
- https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan