PT-2026-29229 · Openclaw · Openclaw

Tdjackey · Published 2026-03-12 · Updated 2026-03-31 · CVE-2026-32921

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.8

Description The software contains an approval bypass issue in the system.run function where mutable script operands are not properly bound during the approval and execution stages. This allows attackers to gain approval for script execution, alter the approved script file before it runs, and then execute modified content while still appearing to execute the originally approved command.

Recommendations Update to version 2026.3.8 or later.

Fix

Improper Authorization

Time Of Check To Time Of Use

Weakness Enumeration

CWE-285

CWE-367

Related Identifiers

CVE-2026-32921

GHSA-8G75-Q649-6PV6

GHSA-WWRJ-437C-PPQ4

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/commit/cf3a479bd1204f62eef7dd82b4aa328749ae6c91 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/c76d29208bf6a7f058d2cf582519d28069e42240 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32921 · Security Note
• https://osv.dev/vulnerability/GHSA-wwrj-437c-ppq4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g75-q649-6pv6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2039004488254607466 · Twitter Post
• https://twitter.com/AgenticYield/status/2039043213772706067 · Twitter Post
• https://vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-system-run · Note