OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

NGHIÊM TRỌNG 9.8CVE-2026-32973 · GHSA-f8r2-vg7x-gh8m · Công bố 29/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-32973 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 35.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.11`	`2026.3.11`
openclaw npm	`< 2026.3.11`	`2026.3.11`

Mô tả

Summary

matchesExecAllowlistPattern normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the ? wildcard could match /, which allowed matches to cross path segments.

Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

Affected versions

openclaw <= 2026.3.8

Patch

Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.

Mô tả của NVD

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.