Security readout for executives and security teams
Plain-English summary
OpenClaw versions before 2026.3.11 have a flaw in how it approves commands to run scripts. A user can approve what looks like a safe script, but the approval does not lock the script file. An attacker who can change that file afterward can have malicious code run under the approved command, bypassing the intended review step.
Executive priority
Treat as urgent patch: update OpenClaw to 2026.3.11 across development and CI environments this cycle, and audit any automated approvals granted to script runners.
Technical view
Per the advisory, OpenClaw's system.run approval flow does not bind mutable file operands for certain runners such as tsx and jiti (CWE-863, Incorrect Authorization). An attacker with low privileges obtains approval for a benign script invocation, then rewrites the referenced script on disk so the runner executes attacker-controlled code within the approved context. Fixed in 2026.3.11; CVSS 4.0 base score 9.4.
Likely exposure
Developer workstations, agent hosts, and CI/CD runners that use OpenClaw with script runners such as tsx or jiti and rely on system.run approvals as a trust boundary. Any environment where an attacker could modify local script files after an approval is granted is materially exposed.
Exploitation context
No public reports of active exploitation and the CVE is not on CISA KEV. Exploitation requires low privileges and user interaction to approve a benign-looking command, per the CVSS vector. The GitHub Security Advisory and VulnCheck advisory describe the weakness but do not indicate in-the-wild abuse at publication.
Researcher notes
Root cause is an authorization/binding gap: the approval identity covers the command string but not the content of the file operand for specific script runners. Focus validation on which runners are enumerated as unrecognized, whether approvals persist across sessions, and whether the fix binds file hashes or resolves runner paths. Confidence is medium because the public description is short and exploitation preconditions (write access to referenced scripts) are not fully detailed.
Mitigation direction
- Upgrade OpenClaw to 2026.3.11 or later on all workstations, agents, and CI runners.
- Restrict which script runners are permitted for system.run approvals per vendor guidance.
- Revoke and re-issue prior standing approvals for tsx, jiti, and similar runners.
- Isolate untrusted repositories and constrain filesystem write access during approved runs.
- Monitor and alert on script file modifications occurring around approved run events.
- Consult the GitHub Security Advisory and VulnCheck advisory for any additional vendor guidance.
Validation and detection
- Confirm installed OpenClaw version is 2026.3.11 or later on every host that runs it.
- Inventory approval records for system.run and identify entries tied to tsx, jiti, or unrecognized runners.
- Test in a lab that approving a benign script no longer authorizes a later-modified script under fixed builds.
- Review endpoint and CI logs for unexpected script rewrites near approved run timestamps.
- Cross-check package manifests and lockfiles in CI to ensure the patched version is pinned.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-32978 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H1.36VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-qc36-x95h-7j53)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script RunnersCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.