CVE-2026-32973CWE-625

OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization

High · published March 29, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00722 · 53.5th percentile
Weakness
CWE-625 · Permissive Regular Expression
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization
    cvelistv5