PT-2026-32077 · Npm · Openclaw

Published 2026-04-01 · Updated 2026-04-01

OSV

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

Allow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers.

Impact

A one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries.

Affected Component

src/infra/exec-approvals-allowlist.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 9ec44fad39 (Exec approvals: reject wrapper carrier allow-always targets).

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-P4X4-2R7F-WJXG

Affected Products

Openclaw

References · 5

• https://osv.dev/vulnerability/GHSA-p4x4-2r7f-wjxg · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg · Note
• https://github.com/openclaw/openclaw/commit/9ec44fad390f0bc1c29c3cc418b322560cb0222b · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Note