PT-2026-25123 · Npm · Openclaw

Published 2026-03-02 · Updated 2026-03-02

OSV

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Summary

system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.2.24
• Patched versions: >= 2026.2.25

Impact

This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence command argv and reuse/obtain a matching approval context.

Trust Model Note

OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).

Fix Commit(s)

• 03e689fc89bbecbcd02876a95957ef1ad9caa176

Release Process Note

patched versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-436

CWE-863

Related Identifiers

GHSA-HWPQ-RRPF-PGCQ

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-hwpq-rrpf-pgcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32065 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcq · Note
• https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176 · Note
• https://vulncheck.com/advisories/openclaw-approval-identity-mismatch-in-system-run-command-execution · Note