CVE-2026-32973 OpenClaw 绕过 exec allowlist 漏洞

OpenClaw中的CVE-2026-32973漏洞，CVSS评分高达9.8，代表着一个关键风险。这是由于matchesExecAllowlistPattern函数中的缺陷导致执行允许列表（exec allowlist）被绕过。具体来说，该函数将模式转换为小写，并以一种导致POSIX路径过度匹配的方式使用glob匹配。攻击者可以利用'?'通配符以非预期的方式匹配路径段，从而执行未授权的命令或访问未授权的文件，从而危及系统安全。此问题的严重性在于易于利用以及对系统机密性、完整性和可用性的潜在影响。

Organizations deploying OpenClaw for any purpose, particularly those using it in environments with untrusted input or where command execution is a core functionality, are at risk. This includes users relying on OpenClaw for data processing, scripting, or automation tasks where user-provided data influences command execution paths.

• python / server:

import os
import subprocess

def check_claw_version():
    try:
        result = subprocess.run(['openclaw', '--version'], capture_output=True, text=True, check=True)
        version = result.stdout.strip()
        if version and float(version.split('.')[2]) < 11:
            print(f"OpenClaw version is vulnerable: {version}")
        else:
            print(f"OpenClaw version is patched: {version}")
    except FileNotFoundError:
        print("OpenClaw not found.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking version: {e}")

check_claw_version()

• generic web: Examine OpenClaw logs for unusual command execution attempts, especially those containing wildcard characters or unexpected path segments.

1. 2026-03-29Disclosure

   disclosure

1. 已保留2026-03-17
2. 发布日期2026-03-29
3. 修改日期2026-03-30
4. EPSS 更新日期2026-04-06

减轻CVE-2026-32973的解决方案是将OpenClaw更新到版本2026.3.11或更高版本。此版本修复了matchesExecAllowlistPattern处理匹配模式的方式，从而防止路径过度匹配。在应用更新时，建议实施额外的安全措施，例如将执行权限限制为必要的用户和进程，并监控系统是否存在可疑活动。及时应用此更新对于保护OpenClaw系统免受潜在攻击至关重要。未能更新会使系统容易受到攻击。