Openclaw cli: OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths (CVE-2026-32973)
Description
OpenClaw CLI versions before 2026.3.11 have a flaw in their exec allowlist pattern matching on POSIX paths. The matching function overmatches due to lowercasing normalization and glob pattern handling, allowing the '?' wildcard to match path separators. This can cause unintended commands or executable paths to be approved by the operator. The issue is fixed in version 2026.3.11 and later.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI's exec allowlist pattern matching function, matchesExecAllowlistPattern, improperly normalizes patterns and targets by lowercasing and using glob matching that is too broad on POSIX systems. Specifically, the '?' wildcard could match the '/' character, allowing matches to cross path segments and overmatch allowlist entries. This flaw could permit execution of commands or paths not intended by the operator. The vulnerability affects openclaw versions from 2026.1.29 up to but not including 2026.3.11. The issue is resolved in version 2026.3.11 and later, where the matching respects intended path semantics and includes regression tests for POSIX case-folding and slash-crossing cases.
Potential Impact
The vulnerability allows the exec allowlist matching to approve commands or executable paths beyond those explicitly intended by the operator. This could lead to unintended execution of commands, potentially increasing the attack surface or enabling unauthorized command execution within the context of the OpenClaw CLI environment.
Mitigation Recommendations
A patch is available and should be applied. The issue is fixed in openclaw version 2026.3.11 and later releases such as 2026.3.12. Users should upgrade to these versions to ensure correct exec allowlist matching behavior that respects POSIX path semantics.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32973
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245b412601ec6a3166b43
Added to database: 10/04/2026, 12:25:24 UTC
Last enriched: 10/04/2026, 12:59:16 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.