Which versions of Openclaw are affected by CVE-2026-32917?

OpenClaw versions prior to 2026.3.13 contain a critical remote command injection vulnerability in iMessage attachment handling that allows unauthenticated attackers to execute arbitrary commands on…. A patch is available.

How to fix or mitigate CVE-2026-32917?

Within 24 hours: Identify all OpenClaw deployments and document which systems have remote attachment staging enabled (highest risk). Within 7 days: Apply vendor patch to upgrade all OpenClaw instances to version 2026.3.13 or later; prioritize systems with remote attachment staging active. Within 30 days: Conduct post-patch validation and implement network segmentation to restrict SCP access from OpenClaw processes to minimize blast radius of future vulnerabilities.

Openclaw CVE-2026-32917

Q: What is the CVSS score of CVE-2026-32917?

CVE-2026-32917 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-17371 CRITICAL

OS Command Injection (CWE-78)

2026-03-31 VulnCheck

Command Injection Openclaw

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17371

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

Patch released

Mar 31, 2026 - 11:45 nvd

Patch available

CVE Published

Mar 31, 2026 - 11:17 nvd

CRITICAL 9.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on openclaw (5 direct, 4 indirect)

Ecosystem-wide dependent count for version 2026.3.13.

DescriptionCVE.org

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remote attachment staging is enabled.

AnalysisAI

Remote command injection in OpenClaw's iMessage attachment staging mechanism (versions prior to 2026.3.13) allows unauthenticated network attackers to execute arbitrary commands on configured remote hosts via malicious attachment paths. The critical flaw stems from unsanitized shell metacharacters passed directly to SCP operations, achieving full system compromise (CVSS 9.8) when remote attachment staging is enabled. EPSS data and KEV status not provided; publicly available exploit code exists (GitHub commit demonstrates the fix, implying POC-level understanding in security community).

Technical ContextAI

This vulnerability affects OpenClaw (cpe:2.3:a:openclaw:openclaw), manifesting as a CWE-78 OS Command Injection weakness. The flaw resides in the iMessage attachment staging workflow where the application constructs SCP (Secure Copy Protocol) commands to transfer attachments to remote hosts. The vulnerability occurs because user-controlled attachment path data-specifically remote attachment paths embedded in iMessage metadata-are concatenated into shell commands without proper input sanitization or validation. Shell metacharacters (such as semicolons, pipes, backticks, or command substitution syntax) embedded in these paths are interpreted by the underlying shell during SCP execution, breaking out of the intended command context. This is a classic example of improper neutralization of special elements used in OS commands, where the trust boundary between user input and system command execution is not enforced. The vulnerability requires remote attachment staging to be enabled in the OpenClaw configuration, suggesting this is an optional feature for distributed or cloud-based deployment scenarios.

RemediationAI

Vendor-released patch: OpenClaw version 2026.3.13 or later. Organizations running affected versions should immediately upgrade to OpenClaw 2026.3.13, which implements proper input validation and sanitization of remote attachment paths before passing them to SCP operations. The specific remediation commit is available at https://github.com/openclaw/openclaw/commit/a54bf71b4c0cbe554a84340b773df37ee8e959de for technical review and verification. As an interim workaround for environments where immediate patching is not feasible, administrators should disable remote attachment staging functionality in OpenClaw configuration files until the upgrade can be completed. This workaround completely eliminates the attack vector but may impact operational workflows dependent on remote attachment processing. Network-level controls such as restricting access to OpenClaw instances via firewall rules or VPN requirements can reduce exposure but do not eliminate risk from internal threats or lateral movement scenarios. Post-upgrade, administrators should audit logs for suspicious SCP command execution patterns or unexpected remote command activity that may indicate prior exploitation attempts. Refer to the official GitHub security advisory (GHSA-g2f6-pwvx-r275) for additional vendor guidance and detection strategies.