CVE-2026-32058

LOW

2.6

Descricao

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.

Detalhes CVE

Pontuacao CVSS v3.12.6

SeveridadeLOW

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado3/21/2026

Ultima modificacao3/24/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

openclaw:openclaw

Fraquezas (CWE)

CWE-863

Referencias

https://github.com/openclaw/openclaw/commit/10481097f8e6dd0346db9be0b5f27570e1bdfcfa(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-hjvp-qhm6-wrh2(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-approval-context-binding-weakness-in-system-run-via-host-node(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.