CVE-2026-32017

Katalog CVE

CVSS 7.1 · High EPSS 0,46%

Kerentanan Incomplete List of Disallowed Inputs pada openclaw. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-option payloads. Attackers can bypass argument validation by attaching short options like -o to whitelisted binaries, enabling unauthorized file-write operations that should be denied by safeBins checks.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3x3x-h76w-hp98 advisory vendor
• https://github.com/openclaw/openclaw/commit/bafdbb6f112409a65decd3d4e7350fbd637c7754 patch
• https://github.com/openclaw/openclaw/commit/cfe8457a0f4aae5324daec261d3b0aad1461a4bc patch
• https://github.com/openclaw/openclaw/commit/fec48a5006eab37c6a5821726ccaeec886486b13 patch
• https://www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-short-option-bypass-in-exec-allowlist advisory pihak ketiga