CVE-2026-32921
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
OpenClaw before version 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.
Risk Assessment
Attackers can execute arbitrary code on the server, potentially leading to full system compromise, data leakage, or service disruption.
Recommendation
Update OpenClaw to version 2026.3.8 or later and implement operand binding between approval and execution phases.
Original NVD description (English source)
OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.