PT-2026-26727 · Openclaw · Openclaw

Baozongwixd · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32044

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw is susceptible to an issue related to archive extraction within the tar.bz2 installer path. This bypasses established safety checks applied to other archive formats. An attacker can create specially crafted malicious tar.bz2 skill archives to circumvent blocking of special entries and size limitations, potentially leading to a local denial of service during skill installation.

Recommendations Update OpenClaw to version 2026.3.2 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-409

CWE-400

Related Identifiers

CVE-2026-32044

GHSA-77HF-7FQF-F227

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/0dbb92dd2bcf9a32379d11c0f11ed016669dae3e · Patch
• https://osv.dev/vulnerability/GHSA-77hf-7fqf-f227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32044 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32044 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-tar-archive-safety-bypass-in-skills-installation · Note
• https://twitter.com/CVEnew/status/2035262090475147269 · Twitter Post