Which versions of Openclaw are affected by CVE-2026-32920?

CVE-2026-32920 is a critical remote code execution vulnerability in OpenClaw versions prior to 2026.3.12 that allows attackers to execute arbitrary code on developer machines when malicious…. A patch is available.

How to fix or mitigate CVE-2026-32920?

Within 24 hours: Identify all OpenClaw installations and their versions via inventory/endpoint management tools; block cloning from untrusted repositories where possible. Within 7 days: Upgrade to OpenClaw 2026.3.12 or later on all developer systems and CI/CD infrastructure; conduct mandatory security briefing on repository trust practices. Within 30 days: Audit recent repository cloning activity logs for suspicious plugins in .OpenClaw/extensions/ directories; implement policy restricting plugin loading to signed/whitelisted sources only; review Git commit history on critical repositories for injected malicious files.

Openclaw CVE-2026-32920

Q: What is the CVSS score of CVE-2026-32920?

CVE-2026-32920 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17373 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-03-31 VulnCheck

GHSA-j5qh-5234-4rqp

GHSA-99qw-6mr3-36qr

RCE Openclaw

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17373

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:17 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.12.

DescriptionCVE.org

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

AnalysisAI

Remote code execution in OpenClaw (versions prior to 2026.3.12) enables attackers to execute arbitrary malicious code when users open compromised repositories. The vulnerability stems from automatic plugin loading from .OpenClaw/extensions/ directories without trust verification, allowing attackers to embed malicious workspace plugins in cloned Git repositories. CVSS 9.8 (Critical) reflects network-based exploitation requiring no authentication or user interaction. No public exploit identified at time of analysis, though the attack mechanism is straightforward for social engineering scenarios targeting developers.

Technical ContextAI

OpenClaw implements an extensibility model through automatic plugin discovery, scanning .OpenClaw/extensions/ directories for loadable modules when the application launches from a workspace. This design follows CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where the application trusts code from user-controlled filesystem locations without cryptographic signature verification, sandboxing, or explicit user consent. The vulnerability affects the core plugin loading mechanism in the OpenClaw application (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). When a developer clones a repository containing a malicious .OpenClaw/extensions/ directory and launches OpenClaw from that working directory, the application automatically loads and executes plugin code with the same privileges as the OpenClaw process itself, effectively granting arbitrary code execution. This represents a supply chain attack vector where malicious actors can weaponize the development toolchain itself by embedding payloads in seemingly legitimate project repositories.

RemediationAI

Vendor-released patch: OpenClaw version 2026.3.12 addresses this vulnerability by implementing trust verification for plugin loading. Users should immediately upgrade to OpenClaw 2026.3.12 or later through standard distribution channels. The security advisory is available at https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr with complete remediation guidance. Until patching is complete, organizations should implement compensating controls including restricting OpenClaw usage to trusted repositories only, implementing code review processes for any .OpenClaw/extensions/ directories in cloned repositories before opening projects, and considering filesystem monitoring to detect unexpected plugin loading attempts. Development teams should educate users about the risks of opening untrusted repositories with vulnerable OpenClaw versions and establish repository vetting procedures as part of secure development practices.