Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-29 | 4 | Disclosure3Patch1 |
| 2026-03-30 | 1 | Disclosure1 |
🚨 CVE-2026-32973 — CVSS 9.8/10 ██████████ OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/y1qm5rxkOo
Post summary
OpenClaw versions prior to 2026.3.11 contain a critical exec allowlist bypass vulnerability (CVE-2026-32973, CVSS 9.8). A patch is now available.
🚨 Critical CVEs Today: OpenClaw Platform (CVSS 9.8-9.9) Affected: OpenClaw Platform OpenClaw components expose multiple high-severity flaws spanning privilege escalation, authorization bypass, and pairing verification risks. - CVE-2026-32922 (CVSS 9.9) OpenClaw before 2026.3.11 contains a privilege escalation in device.token.rotate that can let callers with operator.pairing scope mint tokens with broader scopes; attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via http://system.run or gain unauthorized gateway-admin access. Affected versions: before 2026.3.11. - CVE-2026-32924 (CVSS 9.8) OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats, enabling bypass of groupAllowFrom and requireMention protections in group chat reaction-derived events. Affected versions: before 2026.3.12. - CVE-2026-32973 (CVSS 9.8) OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths; attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators. Affected versions: before 2026.3.11. - CVE-2026-32975 (CVSS 9.8) OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers; attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent. Affected versions: before 2026.3.12. - CVE-2026-32987 (CVSS 9.8) OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts; attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin. Affected versions: before 2026.3.13. 🛠️ Action • Patch/upgrade to fixed OpenClaw versions 2026.3.11+ for CVE-2026-32922 and CVE-2026-32973, 2026.3.12+ for CVE-2026-32924 and CVE-2026-32975, and 2026.3.13+ for CVE-2026-32987. • Prioritize internet-facing instances and edge appliances first. • If no fix yet appears for any CVE, apply vendor-murnished mitigations and reduce exposure (disable feature/module, restrict access). • Add detections for exploitation patterns (token-rotation misuse, reaction-event anomalies, unusual path-matching behaviors, and replay attempts in pairing flows). • Hunt for indicators around the affected services during disclosure-to-now window (logs, EDR, WAF). • Validate remediation (version checks, config verification) and monitor for reversion
Post summary
The post announces multiple high‑severity CVEs in OpenClaw, provides technical details and patch guidance, but does not mention active exploitation or PoC availability.
CVE-2026-32973 OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob m… https://www.cve.org/CVERecord?id=CVE-2026-32973
Post summary
CVE‑2026‑32973 reveals an exec allowlist bypass vulnerability in OpenClaw versions before 2026.3.11, caused by improper pattern normalization with lowercasing and globbing, with no mention of patches or active exploitation.
[CVE-2026-32973: CRITICAL] Critical vulnerability found in OpenClaw before 2026.3.11 allows exec allowlist bypass, enabling attackers to execute unintended paths using wildcard matching. #CyberSecurity#cve,CVE-2026-32973,#cybersecurity https://cvefind.com/CVE-2026-32973
Post summary
A critical exec allowlist bypass vulnerability (CVE-2026‑32973) has been disclosed for OpenClaw versions prior to 2026.3.11, allowing attackers to run unintended paths via wildcard matching.
🔴 CVE-2026-32973 - Critical OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatc... https://www.thehackerwire.com/vulnerability/CVE-2026-32973/ https://t.co/eXzFMOV9f4
Post summary
The post announces the discovery of a critical exec allowlist bypass vulnerability in OpenClaw versions prior to 2026.3.11, providing a brief technical description but no PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |