CVE-2026-32058CWE-863

OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node

Low · published March 21, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00359 · 28.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-21T00:42Z
EPSS history
Timeline
  • 21 MAR 00:42Z
    OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node
    cvelistv5