CVE-2026-32921

MEDIUM

OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run

Title source: cna

Description

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.

References (4)

[Third Party Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6

[Patch] https://github.com/openclaw/openclaw/commit/c76d29208bf6a7f058d2cf582519d28069e42240

[Patch] https://github.com/openclaw/openclaw/commit/cf3a479bd1204f62eef7dd82b4aa328749ae6c91

View Patch ZIP pw:eip

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-system-run

Scores

CVSS v3 6.3

EPSS 0.0006

EPSS Percentile 17.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-367

Status published

Products (4)

npm/openclaw 0 - 2026.3.8npm

OpenClaw/OpenClaw < 2026.3.8

openclaw/openclaw < 2026.3.8

OpenClaw/OpenClaw 2026.3.8

Published Mar 31, 2026

Tracked Since Mar 31, 2026