EUVD-2026-13966Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Impact | The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) indicates network attack vector with high complexity and low privileges required, demanding user interaction (approval action), with high integrity impact and no confidentiality or availability impact. The score of 4.8 is in the low-to-medium range, which may underestimate real risk in environments where OpenClaw is used for privileged operations. The high complexity reflects the need for an attacker to craft trailing-space payloads and coordinate with the approval workflow, while the low privilege requirement suggests the attack is feasible for any authenticated user. The user interaction requirement (UI:R) is critical—an approver must manually review and approve a command, and the attacker must successfully execute a command under an already-approved context. A patch is available from the vendor (commit 03e689fc89bbecbcd02876a95957ef1ad9caa176 on GitHub), which is a strong signal for prioritization. Without confirmation of active exploitation, KEV listing, or public proof-of-concept code, this should be treated as a moderate priority—important for systems running versions prior to 2026.2.25, but not an emergency. The combination of required user interaction, network accessibility, and patch availability suggests this is a real but not critical priority. |
| Exploit ScenarioDerived | A low-privileged authenticated user in an organization using OpenClaw crafts a command such as 'system.run /usr/bin/safe_tool ' (with a trailing space) and requests approval. The approval interface displays '/usr/bin/safe_tool' (trimmed), which appears legitimate and is approved by an administrator. At runtime, the system executes '/usr/bin/safe_tool ' (with the trailing space), which the OS resolves to a different binary placed by the attacker in the PATH or via symlink manipulation, resulting in execution of malicious code under the OpenClaw runtime user's privileges. If the runtime user has elevated access or network-facing responsibilities, this enables privilege escalation or lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 21, 2026
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in the system.run function where the rendered command text displayed to approvers has whitespace trimmed from argv tokens, but the actual runtime execution uses the raw, untrimmed argv. An attacker with the ability to influence command arguments and reuse an approval context can craft a trailing-space executable token to execute a different binary than what was approved, resulting in arbitrary command execution under the OpenClaw runtime user. The CVSS score of 4.8 reflects the requirement for local privileges and user interaction, though the integrity impact is marked as high due to the ability to execute unauthorized commands.
RemediationAI
Upgrade OpenClaw to version 2026.2.25 or later immediately. The vendor has published a fix in the commit 03e689fc89bbecbcd02876a95957ef1ad9caa176 available at https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176 and documented in the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcq. Until patching is completed, restrict access to OpenClaw to trusted administrators only, audit and validate all approval workflows for commands containing trailing spaces in executable tokens, implement network segmentation to limit lateral movement from the OpenClaw runtime user account, and enforce code review processes for any command argument construction to prevent attacker-controlled whitespace injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a command execution framework identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*. The vulnerability exists in the system.run function, which implements an approval workflow where human reviewers validate commands before execution. The root cause is classified under CWE-436 (Untrusted Rendering of Prompts in a Command Execution Feature), a category addressing the mismatch between what users approve and what actually executes. The flaw occurs because the approval identity logic trims whitespace from argv tokens when rendering the command for human review, creating a normalized display, while the actual subprocess execution uses the raw argv array without trimming. This allows an attacker to inject trailing spaces into executable names (e.g., 'malicious_binary ' vs 'malicious_binary') which appear identical after trimming but execute different binaries at runtime. The vulnerability requires an attacker to have write access to influence command construction and the ability to reuse an approval context already granted by an administrator.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to execute a different binary than what the approver displayed, allowing unexpected command execution under the OpenClaw runtime user when they can influence command argv and reuse an approval context.
Executive ViewAI
CVE-2026-32065 presents moderate security risk rated CVSS 4.8. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OpenClaw Multiple Authorization and Command Execution
View all 20Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Exploit-DB