CVE-2026-32973: Exec Allowlist Bypass in OpenClaw

The impact of this vulnerability is severe. An attacker can leverage the improper wildcard matching to execute arbitrary commands or access files outside the intended scope of the allowlist. This could lead to complete system compromise, data exfiltration, or denial of service. The ? wildcard's behavior across path segments is exploited, allowing attackers to bypass security controls designed to restrict command execution to specific, safe paths. This bypass effectively grants the attacker the ability to execute commands with the privileges of the OpenClaw process, potentially escalating privileges and gaining control of the underlying system.

1. Reserved2026-03-17
2. Published2026-03-29
3. Modified2026-03-30
4. EPSS updated2026-04-06

The primary mitigation for CVE-2026-32973 is to immediately upgrade OpenClaw to version 2026.3.11 or later. If upgrading is not immediately feasible, consider implementing stricter input validation and sanitization on any user-provided data used in command execution. While a direct workaround is unavailable, carefully review and restrict the paths and commands allowed by the exec allowlist. Monitor system logs for unusual command execution patterns, particularly those involving wildcard characters. After upgrading, confirm the fix by attempting to execute commands using patterns that previously bypassed the allowlist; these should now be blocked.