VulnSocial

CVE-2026-32920Disclosure(openclaw / openclaw)

LOWCVSS 8.8 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

openclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-829

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • 4 total mentions across 1 day

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-03-31: 4Technical Details · 2026-03-31: 403-31
Signal classification1 categories
Disclosure
4100.0%
Referenced assets3 URLs
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-32920 OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution.… https://www.cve.org/CVERecord?id=CVE-2026-32920

    Post summary

    The brief announcement highlights that OpenClaw versions prior to 2026.3.12 are vulnerable to arbitrary code execution due to lack of trust verification when loading plugins, with no evidence of PoC, exploit code, or active exploitation provided.

    00000172
    56.9K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-32920: CRITICAL] OpenClaw vulnerability pre-2026.3.12 auto loads unverified plugins, risking arbitrary code execution. Beware of malicious code in cloned repositories. #cybersecurity#cve,CVE-2026-32920,#cybersecurity https://cvefind.com/CVE-2026-32920

    Post summary

    The text announces a critical OpenClaw vulnerability (CVE-2026-32920) that allows arbitrary code execution via auto‑loaded, unverified plugins; it contains technical details but no exploit code, PoC, or patch information.

    0000044
    617 followersView on X
  • Abcas MCP Guard@abcas_mcp_guard
    Disclosure

    CVE-2026-32920: OpenClaw plugins load without verification, leading to RCE. Static analysis isn't enough when AI agents can be tricked into loading malicious extensions. 🛡️ Runtime validation is the only way to secure the bridge. #MCPSecurity #OpenClaw

    Post summary

    The post announces CVE-2026-32920, noting that OpenClaw plugins load without verification and enabling remote code execution, but provides no proof of concept, exploit, or remediation details.

    0000030
    11 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-32920 - Critical OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execut... https://www.thehackerwire.com/vulnerability/CVE-2026-32920/ https://t.co/DgWzTcc5C4

    Post summary

    The post announces a critical vulnerability (CVE-2026-32920) in OpenClaw that permits arbitrary code execution via unverified plugin loading.

    0000058
    163 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities