PT-2026-24669 · Git+2 · Openclaw

Tdjackey · Published 2026-02-27 · Updated 2026-03-17 · CVE-2026-32059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.22-2 through 2026.2.22-2

Description The tools.exec.safeBins validation for the sort command does not properly validate GNU long-option abbreviations. This allows attackers to bypass denied-flag checks using abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements when operating in allowlist mode. The issue occurs when tools.exec.security is set to allowlist, tools.exec.ask is set to on-miss, and tools.exec.safeBins includes sort. Long-option handling matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed.

Recommendations Update OpenClaw to version 2026.2.23 or later.

Fix

Incomplete List of Disallowed Inputs

Incorrect Authorization

Weakness Enumeration

CWE-184

CWE-863

Related Identifiers

CVE-2026-32059

GHSA-3C6H-G97W-FG78

GHSA-7977-C43C-XPWJ

Affected Products

Openclaw

References · 19

• https://github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7977-c43c-xpwj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c6h-g97w-fg78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28363 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32059 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.23 · Note
• https://twitter.com/botnewsnetwork/status/2031822228980134215 · Twitter Post
• https://t.me/CVEtracker/47131 · Telegram Post
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-sort-long-option-abbreviation-in-toolsexecsafebins · Note
• https://twitter.com/CveFindCom/status/2031749720452808774 · Twitter Post
• https://twitter.com/RedPacketSec/status/2031894866729242980 · Twitter Post
• https://twitter.com/CVEnew/status/2033194294493032653 · Twitter Post