PT-2026-26727 · Openclaw · Openclaw

Baozongwixd · Publicado 2026-03-03 · Atualizado 2026-03-21 · CVE-2026-32044

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw is susceptible to an issue related to archive extraction within the tar.bz2 installer path. This bypasses established safety checks applied to other archive formats. An attacker can create specially crafted malicious tar.bz2 skill archives to circumvent blocking of special entries and size limitations, potentially leading to a local denial of service during skill installation.

Recommendations Update OpenClaw to version 2026.3.2 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-409

CWE-400

Identificadores relacionados

CVE-2026-32044

GHSA-77HF-7FQF-F227

Produtos afetados

Openclaw

Referências · 8

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/0dbb92dd2bcf9a32379d11c0f11ed016669dae3e · Correção
• https://osv.dev/vulnerability/CVE-2026-32044 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-77hf-7fqf-f227 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32044 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035262090475147269 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-tar-archive-safety-bypass-in-skills-installation · Nota