CVE-2026-32015CWE-426

OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation

High · published March 19, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling process PATH resolution. Attackers who can influence the gateway process PATH or launch environment can execute trojan binaries with allowlisted names, such as jq, circumventing executable validation controls.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2026-03-19T22:06Z
EPSS history
Timeline
  • 19 MAR 22:06Z
    OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation
    cvelistv5