CVE-2026-32973 in OpenClaw
Sumário (Inglês)
OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.
Responsável
VulnCheck
Reservar
17/03/2026
Divulgação
29/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354110 | OpenClaw Execução remota de código | 625 | Não definido | Correção oficial | CVE-2026-32973 |