by Kastro
Paper/Archive/CVE-2026-32978

CVE-2026-32978

OpenClaw OpenClaw — OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
30
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 7.8.078 × 201.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.3.112026.3.11CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
VulnCheck (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53writeupvulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners