CVE-2026-32978

Katalog CVE

CVSS 7.5 · High EPSS 0,32%

Kerentanan Incorrect Authorization pada openclaw. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.

Rincian

Terbit di NVD

29 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53 mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-unrecognized-script-runners advisory pihak ketiga