PT-2026-29231 · Openclaw · Openclaw

Tdjackey · CVE-2026-32971 · Publicado 2026-03-13 · Atualizado 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description The software contains an approval-integrity issue within the node-host system.run approvals functionality. This allows the display of extracted shell payloads instead of the executed arguments. An attacker can leverage this by placing wrapper binaries and inducing wrapper-shaped commands, potentially leading to local code execution after an operator approves misleading command text.

Recommendations Update to version 2026.3.11 or later.

Exploit

Correção

UI Misrepresentation of Critical Information

Incorrect Authorization

Enumeração de Fraquezas

CWE-451

CWE-863

CWE-436

Identificadores relacionados

CVE-2026-32971

GHSA-RW39-5899-8MXP

GHSA-W8RF-7QF8-65WW

Produtos afetados

Openclaw

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32971.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-rw39-5899-8mxp · Aviso do Fabricante
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Nota
• https://osv.dev/vulnerability/GHSA-rw39-5899-8mxp · Aviso do Fabricante
• https://twitter.com/token4agent/status/2039183673560608850 · Publicação no Twitter
• https://twitter.com/subagentic/status/2039183616488649144 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-node-host-approval-ui-mismatch-allows-execution-of-unintended-commands · Nota
• https://osv.dev/vulnerability/GHSA-w8rf-7qf8-65ww · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004485989568936 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32971 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32971 · Nota de Segurança