Vulnerability Description
OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands with the privileges of the OpenClaw process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.2.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/25e89cc86338ef475d26be043aa541dfdb95Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-f8mp-vj46-cq8vVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-arbitrary-shell-execution-via-unvaThird Party Advisory
FAQ
What is CVE-2026-32032?
CVE-2026-32032 is a vulnerability with a CVSS score of 7.8 (HIGH). OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with...
How severe is CVE-2026-32032?
CVE-2026-32032 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32032?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.