What is the CVSS score of CVE-2026-32047?

CVE-2026-32047 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L.

Which versions of Openclaw are affected by CVE-2026-32047?

Organizations using OpenClaw before 2026.2.22 should be aware of moderate risk from CVE-2026-32047, a incorrect authorization vulnerability rated CVSS 5.8.. A patch is available.

How to fix or mitigate CVE-2026-32047?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-32047

EUVD-2026-14564 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-23 VulnCheck

GHSA-jjhv-9r5q-4vqg

Authentication Bypass Openclaw

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14564

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 5.8

DescriptionCVE.org

OpenClaw before 2026.2.22 contains an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation. Attackers can bypass shell-wrapper analysis by injecting $\\ followed by newline and ( inside double quotes, causing the shell runtime to fold the payload into $(...)and execute arbitrary subcommands.

AnalysisAI

OpenClaw before version 2026.2.22 contains a critical allowlist bypass vulnerability in the system.run function that allows authenticated local attackers to execute arbitrary commands by circumventing security controls. An attacker with local access and low privileges can inject shell line-continuation sequences and command substitution syntax within double quotes to fold malicious payloads into executable subcommands, effectively bypassing the intended command allowlist. This vulnerability enables privilege escalation and arbitrary code execution on affected systems.

Technical ContextAI

The vulnerability exploits a flaw in OpenClaw's shell command wrapper analysis mechanism, which is responsible for validating and allowlisting commands executed through the system.run function. The root cause is classified under CWE-863 (Incorrect Authorization), indicating a failure to properly validate and restrict command execution. The attack vector leverages shell metacharacters, specifically the line-continuation character (backslash) followed by newline and parenthesis within double-quoted strings. When processed by the shell runtime, these characters cause the shell parser to fold the split payload into a valid command substitution expression $(…), which then executes the attacker's injected subcommands. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw), a tool that appears to be designed with security-critical command execution capabilities that require strict input validation.

RemediationAI

Upgrade OpenClaw immediately to version 2026.2.22 or later to apply the vendor's security patch, which is available via the official GitHub repository commit 3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9. Consult the official GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9868-vxmx-w862 and VulnCheck's advisory at https://vulncheck.com/advisories/openclaw-mar-allowlist-bypass-via-shell-line-continuation-command-substitution-in-system-run for detailed upgrade instructions. As an interim mitigation pending patching, restrict local access to OpenClaw to trusted users only, implement strict input validation on any user-supplied data passed to system.run functions, and consider implementing shell execution sandboxing or mandatory access controls (SELinux/AppArmor) to limit the scope of command injection attacks.