PT-2026-26727 · Openclaw · Openclaw

Baozongwixd · CVE-2026-32044 · Published 2026-03-03 · Updated 2026-03-21

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw is susceptible to an issue related to archive extraction within the tar.bz2 installer path. This bypasses established safety checks applied to other archive formats. An attacker can create specially crafted malicious tar.bz2 skill archives to circumvent blocking of special entries and size limitations, potentially leading to a local denial of service during skill installation.

Recommendations Update OpenClaw to version 2026.3.2 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-409

Related Identifiers

CVE-2026-32044

GHSA-77HF-7FQF-F227

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32044.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/0dbb92dd2bcf9a32379d11c0f11ed016669dae3e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32044 · Security Note
• https://osv.dev/vulnerability/GHSA-77hf-7fqf-f227 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32044 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2035262090475147269 · Twitter Post
• https://vulncheck.com/advisories/openclaw-tar-archive-safety-bypass-in-skills-installation · Note