CVE-2026-32921

Katalog CVE

CVSS 5.0 · Medium EPSS 0,33%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openclaw. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6 advisory vendor
• https://github.com/openclaw/openclaw/commit/c76d29208bf6a7f058d2cf582519d28069e42240 patch
• https://github.com/openclaw/openclaw/commit/cf3a479bd1204f62eef7dd82b4aa328749ae6c91 patch
• https://www.vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-syste... advisory pihak ketiga