Is there a patch available for EUVD-2026-17375?

Yes, a patch is available for EUVD-2026-17375. Update the affected software to the latest version immediately.

Openclaw EUVD-2026-17375

Q: What is the CVSS score of EUVD-2026-17375?

EUVD-2026-17375 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32921 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-03-31 VulnCheck

GHSA-wwrj-437c-ppq4

Authentication Bypass Openclaw

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17375

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

Patch released

Mar 31, 2026 - 11:45 nvd

Patch available

CVE Published

Mar 31, 2026 - 11:17 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.8.

DescriptionCVE.org

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.

AnalysisAI

OpenClaw before 2026.3.8 allows authenticated remote attackers to bypass approval controls in the system.run function by obtaining approval for a script, modifying the approved script file before execution, and executing malicious content while preserving the approved command structure. This approval-execution window vulnerability enables privilege escalation and code execution with low complexity and no user interaction required. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from a race condition (CWE-367: Time-of-Check Time-of-Use) in OpenClaw's approval workflow for the system.run function. The approval mechanism checks and binds script operands at approval time, but these bindings are not retained or re-validated during the execution phase. Attackers with authenticated access can modify mutable script operands on disk between approval grant and actual execution, allowing the executor to run different code than what was approved. This affects the script approval chain-of-custody in OpenClaw's workflow automation system (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), where system.run is likely a critical function for executing arbitrary commands or scripts as part of orchestration workflows.

RemediationAI

Upgrade OpenClaw to version 2026.3.8 or later to obtain the vendor-released patch. The upstream fix is available via GitHub commits c76d29208bf6a7f058d2cf582519d28069e42240 and cf3a479bd1204f62eef7dd82b4aa328749ae6c91, which address the mutable operand binding vulnerability by ensuring script operands are immutably bound at approval time and validated against stored bindings at execution time. Users unable to immediately upgrade should restrict write access to approved script files and enforce separation of duties between approval and execution roles. For detailed remediation guidance, consult the official security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-system-run.