CVE-2026-32973 in OpenClaw
Resumen (Inglés)
OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.
Responsable
VulnCheck
Reservar
2026-03-17
Divulgación
2026-03-29
Voces
| ID | Vulnerabilidad | CWE | Base | Temp | 0day | Hoy | Exp | KEV | EPSS | CTI | Con | CVE |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 354110 | OpenClaw Ejecución remota de código | 625 | 8.5 | 8.4 | $0-$5k | $0-$5k | No está definido | 0.00000 | 1.89 | Arreglo oficial | CVE-2026-32973 |