CVE-2026-32058

OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node

CVSS 2 LOWEPSS 0.2%CWE-863

Vexday Risk Score

8Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

21 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

OpenClaw · OpenClaw

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/openclaw/openclaw/commit/10481097f8e6dd0346db9be0b5f27570e1bdfcfa https://github.com/openclaw/openclaw/security/advisories/GHSA-hjvp-qhm6-wrh2 https://www.vulncheck.com/advisories/openclaw-approval-context-binding-weakness-in-system-run-via-host-node