PT-2026-29228 · Openclaw · Openclaw

Lintsinghua · Publicado 2026-03-13 · Atualizado 2026-03-31 · CVE-2026-32920

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12

Description OpenClaw automatically discovers and loads plugins from the .OpenClaw/extensions/ directory without verifying their trustworthiness, which can lead to arbitrary code execution. An attacker can exploit this by including malicious workspace plugins in cloned repositories. When a user runs OpenClaw from such a directory, the malicious code is executed. The application automatically ingests extensions from the .OpenClaw/extensions/ path, increasing the risk of arbitrary code execution as malicious code could be executed without verification.

Recommendations Update OpenClaw to version 2026.3.12 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2026-32920

GHSA-99QW-6MR3-36QR

GHSA-J5QH-5234-4RQP

Produtos afetados

Openclaw

Referências · 12

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr · Aviso do Fabricante
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Nota
• https://osv.dev/vulnerability/GHSA-99qw-6mr3-36qr · Aviso do Fabricante
• https://twitter.com/abcas_mcp_guard/status/2038959269777907791 · Publicação no Twitter
• https://reddit.com/r/pwnhub/comments/1s8rna1/critical_openclaw_rce_flaw_exposes_users_to · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32920 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j5qh-5234-4rqp · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004489303097723 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038955738761216489 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-auto-discovery-of-workspace-plugins · Nota
• https://twitter.com/CveFindCom/status/2038960380458750111 · Publicação no Twitter