AI agent vulnerability · OpenClaw

CVE-2026-32016: OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

mediumCVSS 4.0 5.1 · 3.1 7.8GHSA-7f4q-9rqh-x36p

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example echo) as trusted command matches. This could allow a same-name local binary (for example ./echo) to run without approval under security=allowlist + ask=on-miss. Scope / Preconditions - macOS node-host path. - Optional exec approvals feature enabled with security=allowlist.

Published Mar 3, 2026 · Updated Mar 30, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.22
Fixed in: 2026.2.22
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example echo) as trusted command matches. This could allow a same-name local binary (for example ./echo) to run without approval under security=allowlist + ask=on-miss.

Scope / Preconditions

macOS node-host path.
Optional exec approvals feature enabled with security=allowlist.
Basename-only allowlist entries configured.

Default install posture is not impacted: security=deny by default.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.2.21-2
Vulnerable range: <=2026.2.21-2
Planned patched version (next release): >= 2026.2.22

Remediation

Enforced path-only allowlist matching on macOS node-host (basename fallback removed).
Added migration for legacy basename allowlist entries to last-resolved paths when available.
UI/store validation now rejects non-path allowlist patterns.

Fix Commit(s)

dd41fadcaf58fd9deb963d6e163c56161e7b35dd

Release Process Note

Patched version is pre-set for the planned next release (2026.2.22). Once that npm release is out, advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries