CVE-2026-32059: fallo de gravedad alta en openclaw
OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.6%
probabilidad de explotación
0.6%top 52% de las CVE
explotación observada
noninguna fuente lo reporta
OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
openclaw · openclawCVEs relacionadas — openclaw
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-26323HIGHOpenClaw has a command injection in maintainer clawtributors updaterEPSS 2.1%CVE-2026-27487HIGHOpenClaw: Prevent shell injection in macOS keychain credential writeEPSS 1.9%CVE-2026-32063MEDIUMOpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit GenerationEPSS 1.3%CVE-2026-25157HIGHOpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommandEPSS 1.1%CVE-2026-32060HIGHOpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted PathsEPSS 1.0%CVE-2026-25593HIGHOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyEPSS 1.0%