Which versions of Openclaw are affected by CVE-2026-32978?

OpenClaw versions before 2026.3.11 contain a critical approval bypass vulnerability (CVSS 9.4) that allows low-privileged authenticated users to execute arbitrary code by exploiting race conditions…. A patch is available.

How to fix or mitigate CVE-2026-32978?

Within 24 hours: Inventory all OpenClaw deployments and identify versions prior to 2026.3.11; disable or restrict access to the system.run approval feature pending remediation. Within 7 days: Implement compensating controls (see section below); review audit logs for suspicious approval-then-execute patterns or file modification anomalies around script execution. Within 30 days: Upgrade to OpenClaw 2026.3.11 or later when available; validate the patch resolves the race condition in tsx/jiti runner file handling; re-enable script execution features with enhanced monitoring.

Openclaw CVE-2026-32978

Q: What is the CVSS score of CVE-2026-32978?

CVE-2026-32978 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17016 CRITICAL

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

GHSA-qc36-x95h-7j53

Authentication Bypass Openclaw

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17016

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

CRITICAL 9.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.

AnalysisAI

Approval bypass in OpenClaw before 2026.3.11 allows low-privileged remote attackers to execute arbitrary code by exploiting race conditions in system.run approvals. Attackers obtain legitimate approval for benign scripts, then overwrite referenced files before execution via vulnerable tsx/jiti runners. With CVSS 9.4 (critical severity, network-accessible, low complexity) and EPSS data not yet available for this 2026 CVE, organizations using OpenClaw's script execution features face immediate risk despite requiring user interaction and low-level authentication. No public exploit identified at time of analysis, though the approval bypass mechanism is documented in vendor advisory GHSA-qc36-x95h-7j53.

Technical ContextAI

This vulnerability affects OpenClaw (cpe:2.3:a:openclaw:openclaw), a command execution framework. The flaw stems from CWE-863 (Incorrect Authorization) in the system.run approval mechanism. When processing execution requests through certain JavaScript runtime interpreters (tsx and jiti), the approval system fails to implement proper time-of-check-time-of-use (TOCTOU) protections by not binding file operands at approval time. The approval validates the script content initially presented but does not lock or hash the file reference, allowing attackers to modify the script on disk between approval and execution. This breaks the fundamental security assumption that approved code matches executed code, effectively bypassing the authorization control meant to prevent arbitrary command execution.

RemediationAI

Upgrade immediately to OpenClaw version 2026.3.11 or later, which implements proper file operand binding for system.run approvals across all script runners including tsx and jiti. The patched version should cryptographically hash or lock file references at approval time to prevent TOCTOU exploitation. Until patching is possible, implement compensating controls including disabling tsx and jiti runners if not operationally required, enforcing strict file system permissions to prevent script modification by low-privileged users, implementing file integrity monitoring on script directories, and requiring elevated approval workflows with reduced approval validity windows to minimize TOCTOU opportunity. Review recent system.run approval logs for suspicious patterns of script modifications immediately following approvals. Consult the official security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53 for additional vendor-specific guidance and migration assistance.