CVE-2026-32032
Received Received - Intake

Arbitrary Shell Execution in OpenClaw via Unvalidated SHELL Variable

Publication date: 2026-03-19

Last updated on: 2026-03-25

Assigner: VulnCheck

Description
OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands with the privileges of the OpenClaw process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-19
Last Modified
2026-03-25
Generated
2026-07-06
AI Q&A
2026-03-20
EPSS Evaluated
2026-07-05
NVD
CVE-2026-32032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.2.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions prior to 2026.2.22 and involves an arbitrary shell execution issue. It occurs because the software's shell environment fallback trusts the SHELL path from the host environment without validating it. An attacker who has local access to the environment can set a malicious SHELL variable, which leads to the execution of arbitrary commands with the same privileges as the OpenClaw process.

Impact Analysis

The impact of this vulnerability is that an attacker with local environment access can execute arbitrary commands on the system with the privileges of the OpenClaw process. This can lead to unauthorized actions such as data modification, data deletion, or further system compromise depending on the privileges of the OpenClaw process.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart