CVE-2026-32009
Policy Bypass in OpenClaw Allows Arbitrary Command Execution
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.2.24 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions prior to 2026.2.24 and involves a policy bypass in the safeBins allowlist evaluation. The system trusts certain static default directories, including writable package-manager paths such as /opt/homebrew/bin and /usr/local/bin. An attacker who has write access to these trusted directories can place a malicious binary with the same name as an allowed executable. This allows the attacker to execute arbitrary commands within the OpenClaw runtime context.
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary command execution by an attacker who can write to trusted directories. This means an attacker could run malicious code with the privileges of the OpenClaw runtime, potentially leading to unauthorized actions, system compromise, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know