Which versions of Openclaw are affected by CVE-2026-32023?

CVE-2026-32023 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 6.0. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-32023?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openclaw CVE-2026-32023

Q: What is the CVSS score of CVE-2026-32023?

CVE-2026-32023 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-19 disclosure@vulncheck.com

GHSA-ccg8-46r6-9qgj

Authentication Bypass Openclaw

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.2.24.

DescriptionCVE.org

OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapper detection. Attackers can exploit this by chaining multiple dispatch wrappers like /usr/bin/env to execute /bin/sh -c commands without triggering the expected approval prompt in allowlist plus ask=on-miss configurations.

AnalysisAI

OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in the system.run allowlist mode where attackers with local privileges can chain multiple transparent dispatch wrappers (such as /usr/bin/env) to suppress shell-wrapper detection and execute arbitrary shell commands without triggering expected approval prompts in allowlist plus ask=on-miss configurations. This authentication bypass has a CVSS score of 5.9 (medium severity) with high integrity impact, allowing privilege escalation or unauthorized command execution on affected systems. A proof-of-concept and security advisory are available from GitHub and VulnCheck.

Technical ContextAI

The vulnerability exists in OpenClaw's system.run command execution framework when operating in allowlist mode with ask=on-miss approval gating enabled. The root cause is classified under CWE-863 (Incorrect Authorization), specifically a failure to properly validate and traverse nested command dispatch wrappers. OpenClaw implements approval prompts to gate dangerous shell command execution, but the detection mechanism uses insufficient depth checking when resolving command execution chains. An attacker can exploit this by nesting transparent wrapper commands like /usr/bin/env multiple layers deep to obfuscate the final /bin/sh -c invocation, causing the approval gate to fail to recognize and block the dangerous operation. The affected product is OpenClaw (no specific CPE variant provided in advisory references), with versions prior to 2026.2.24 being vulnerable.

RemediationAI

Upgrade OpenClaw to version 2026.2.24 or later immediately to apply the fix for nested dispatch wrapper detection in the approval gating logic (see https://github.com/openclaw/openclaw/security/advisories/GHSA-ccg8-46r6-9qgj). As an interim mitigation before patching is possible, disable ask=on-miss mode in allowlist configurations and instead enforce mandatory approval prompts for all system.run commands, or restrict OpenClaw execution to fully trusted administrators with vetted command sets only. Additionally, monitor OpenClaw logs for suspicious use of wrapper commands like /usr/bin/env in command chains and consider implementing file-based access controls to limit invocation of shell interpreters in sensitive execution contexts.