PT-2026-26740 · Openclaw · Openclaw

Tdjackey · Published 2026-03-02 · Updated 2026-03-21 · CVE-2026-32058

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.26

Description The software contains an approval context-binding weakness in system.run execution flows with host=node. This allows reuse of previously approved requests with modified environment variables. An attacker with access to an approval id can exploit this by reusing an approval with changed environment input, bypassing execution-integrity controls in approval-enabled workflows. The host parameter must be set to node for the issue to be exploitable. The vulnerability affects the execution flow of the system.run function.

Recommendations Update OpenClaw to version 2026.2.26 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-15

Related Identifiers

CVE-2026-32058

GHSA-CJQ8-M7WJ-XMQ9

GHSA-HJVP-QHM6-WRH2

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/security/advisories/GHSA-hjvp-qhm6-wrh2 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/10481097f8e6dd0346db9be0b5f27570e1bdfcfa · Patch
• https://osv.dev/vulnerability/CVE-2026-32058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32058 · Security Note
• https://osv.dev/vulnerability/GHSA-cjq8-m7wj-xmq9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjvp-qhm6-wrh2 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2035237329997373746 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035239090237350183 · Twitter Post
• https://vulncheck.com/advisories/openclaw-approval-context-binding-weakness-in-system-run-via-host-node · Note