CVE-2026-32978CWE-863

OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners

Critical · published March 29, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
    cvelistv5