CVE-2026-32023: OpenClaw approval gating bypass

CISO Take

OpenClaw's system.run allowlist mode contains a logic flaw where chaining transparent dispatch wrappers — such as /usr/bin/env followed by /bin/sh -c — suppresses shell-wrapper detection, allowing arbitrary shell commands to execute without triggering the expected approval prompt in ask=on-miss configurations. Any low-privileged authenticated user can exploit this with no user interaction, directly undermining the agentic permission boundary that security teams rely on to contain AI agent actions. At the 81st EPSS percentile, this CVE sits among the top tier for exploitation likelihood despite no current KEV listing or public exploit, and AIID #1368 confirms that OpenClaw's ecosystem is already an active target for credential theft via malicious skills. Patch to OpenClaw 2026.2.24 immediately; if patching is delayed, switch to ask=always mode or disable system.run entirely — on-miss gating should not be treated as a security boundary.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

HIGH risk for organizations deploying OpenClaw-powered AI agents in security-sensitive environments. CVSS 7.1 with AV:N/AC:L/PR:L/UI:N means network-reachable exploitation by any authenticated user with minimal skill. The core risk is architectural: teams that built containment models around OpenClaw's approval gating have a false security assumption. EPSS at 81st percentile signals elevated attacker interest. Blast radius is bounded by the 4 known downstream dependents and the requirement for prior authentication, but the integrity impact is HIGH — successful exploitation gives shell-level command execution. Not in CISA KEV and no public exploit reduces immediate urgency slightly, but the novelty of the dispatch-wrapper evasion technique and the active threat landscape around OpenClaw (AIID #1368) elevate operational risk.

How does the attack unfold?

Authenticated Access

Attacker authenticates to an OpenClaw-powered AI agent platform using low-privilege credentials — valid user account, stolen token, or trial access.

AML.T0012

Wrapper Chain Crafting

Attacker constructs a system.run invocation nesting /usr/bin/env as the outer allowlisted dispatcher with /bin/sh -c as the inner executor, exploiting the depth-cap mismatch in shell-wrapper detection.

AML.T0107

Approval Gate Bypass

OpenClaw's detection logic terminates inspection at the outer /usr/bin/env layer (allowlisted), suppresses the approval prompt, and passes the full command chain to execution without generating an audit event.

AML.T0053

Shell Command Execution

Arbitrary shell commands execute at the agent's OS privilege level — enabling credential exfiltration, filesystem access, or lateral movement depending on the agent's runtime permissions.

AML.T0050

Authenticated Access

Attacker authenticates to an OpenClaw-powered AI agent platform using low-privilege credentials — valid user account, stolen token, or trial access.

AML.T0012

Wrapper Chain Crafting

Attacker constructs a system.run invocation nesting /usr/bin/env as the outer allowlisted dispatcher with /bin/sh -c as the inner executor, exploiting the depth-cap mismatch in shell-wrapper detection.

AML.T0107

Approval Gate Bypass

OpenClaw's detection logic terminates inspection at the outer /usr/bin/env layer (allowlisted), suppresses the approval prompt, and passes the full command chain to execution without generating an audit event.

AML.T0053

Shell Command Execution

Arbitrary shell commands execute at the agent's OS privilege level — enabling credential exfiltration, filesystem access, or lateral movement depending on the agent's runtime permissions.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

PATCH

Upgrade to OpenClaw >= 2026.2.24 (commit 57c9a18 resolves the depth-cap mismatch in dispatch wrapper detection).
WORKAROUND (if patching is delayed): Change configuration from ask=on-miss to ask=always — this forces approval prompts regardless of allowlist status, preventing silent bypass.
DISABLE

If shell access via system.run is not operationally required, disable the feature entirely in OpenClaw configuration.
DETECT

Audit agent execution logs for command chains containing /usr/bin/env followed by /bin/sh, /bash, or /dash — this pattern in logs prior to patching indicates exploitation attempts.
SCOPE

Review which agent deployments run with elevated OS-level permissions and prioritize those for immediate patching — agents with access to credential stores, network interfaces, or sensitive filesystems face highest post-exploitation impact.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity Art. 9 - Risk management system

ISO 42001

6.1.2 - AI risk treatment 8.4 - AI system operation

NIST AI RMF

GOVERN 6.2 - Policies and procedures for AI risk and security

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32023?

OpenClaw's system.run allowlist mode contains a logic flaw where chaining transparent dispatch wrappers — such as /usr/bin/env followed by /bin/sh -c — suppresses shell-wrapper detection, allowing arbitrary shell commands to execute without triggering the expected approval prompt in ask=on-miss configurations. Any low-privileged authenticated user can exploit this with no user interaction, directly undermining the agentic permission boundary that security teams rely on to contain AI agent actions. At the 81st EPSS percentile, this CVE sits among the top tier for exploitation likelihood despite no current KEV listing or public exploit, and AIID #1368 confirms that OpenClaw's ecosystem is already an active target for credential theft via malicious skills. Patch to OpenClaw 2026.2.24 immediately; if patching is delayed, switch to ask=always mode or disable system.run entirely — on-miss gating should not be treated as a security boundary.

Is CVE-2026-32023 actively exploited?

No confirmed active exploitation of CVE-2026-32023 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32023?

1. PATCH: Upgrade to OpenClaw >= 2026.2.24 (commit 57c9a18 resolves the depth-cap mismatch in dispatch wrapper detection). 2. WORKAROUND (if patching is delayed): Change configuration from ask=on-miss to ask=always — this forces approval prompts regardless of allowlist status, preventing silent bypass. 3. DISABLE: If shell access via system.run is not operationally required, disable the feature entirely in OpenClaw configuration. 4. DETECT: Audit agent execution logs for command chains containing /usr/bin/env followed by /bin/sh, /bash, or /dash — this pattern in logs prior to patching indicates exploitation attempts. 5. SCOPE: Review which agent deployments run with elevated OS-level permissions and prioritize those for immediate patching — agents with access to credential stores, network interfaces, or sensitive filesystems face highest post-exploitation impact.

What systems are affected by CVE-2026-32023?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic pipelines with tool approval controls, AI-powered developer assistants, SecOps automation agents, CI/CD pipeline AI agents.

What is the CVSS score for CVE-2026-32023?

CVE-2026-32023 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic pipelines with tool approval controlsAI-powered developer assistantsSecOps automation agentsCI/CD pipeline AI agents

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15, Art. 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapper detection. Attackers can exploit this by chaining multiple dispatch wrappers like /usr/bin/env to execute /bin/sh -c commands without triggering the expected approval prompt in allowlist plus ask=on-miss configurations.

Exploitation Scenario

An attacker with a low-privilege account on a platform running an OpenClaw-powered AI agent (e.g., a developer assistant or SecOps automation tool) crafts a tool invocation that chains /usr/bin/env as the outer dispatcher with /bin/sh -c as the nested executor, appending the desired shell payload. When submitted to system.run, OpenClaw's shell-wrapper detection inspects only the outer /usr/bin/env invocation — which matches an allowlist entry — and fails to recurse into the nested dispatch chain. The depth-cap mismatch causes the detection to terminate early, suppressing the approval prompt. The shell command executes on the host without an approval event being logged, giving the attacker code execution at the agent's OS privilege level. In environments where OpenClaw agents run with access to credential stores or cloud provider tokens (common in CI/CD and SOC automation), this single step can pivot to full environment compromise — a path consistent with the credential exfiltration pattern documented in AIID #1368.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.