CVE-2026-32052: OpenClaw command injection

CISO Take

CVE-2026-32052 is a command injection flaw in OpenClaw's system.run shell wrapper that allows an attacker to embed hidden commands as trailing positional argv arguments — arguments that execute silently while the displayed approval prompt shows entirely different, benign-looking text. This deceptive bypass is especially dangerous in AI agent deployments, where operators rely on displayed tool-call context to authorize actions, effectively weaponizing the human-in-the-loop as part of the exploit chain. Although CVSS is a moderate 6.4 and CISA KEV has not flagged active exploitation, EPSS places this in the top 45% for likely exploitation, and OpenClaw's own incident history — AIID #1368 documented credential theft via malicious skills in the same ecosystem earlier this year — confirms this package is already a high-value target. Upgrade to OpenClaw ≥ 2026.2.24 immediately; if patching is blocked, disable or restrict the system.run executor and audit process-spawn logs from OpenClaw worker processes.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity by CVSS (6.4), but contextually elevated for AI agent environments. The High attack complexity and required user interaction (AV:N/AC:H/PR:L/UI:R) suppress the base score, yet the attack specifically abuses the approval workflow — the user interaction is the mechanism of deception, not a genuine mitigation. The I:H/A:H impact with no confidentiality component suggests the primary risk is integrity corruption and availability disruption. With 396 CVEs recorded in the same package, OpenClaw's overall security posture is poor. Any deployment where OpenClaw agents hold shell access or elevated host privileges should treat this as High-priority regardless of the CVSS medium rating.

How does the attack unfold?

Skill Delivery

Adversary publishes a malicious skill to OpenClaw's community hub or compromises an existing trusted skill, embedding a crafted system.run invocation with hidden argv payload appended after the inline shell command.

AML.T0011.002

Approval Masquerade

When the skill executes, system.run displays benign approval text such as 'checking network status' while the actual malicious command is concealed in trailing positional arguments that bypass display context validation.

AML.T0074

User-Approved Execution

The user or automated orchestrator approves the innocuous-looking request; the shell wrapper executes the hidden command with the agent's full process privileges.

AML.T0050

Exfiltration or Persistence

The injected command exfiltrates credentials, API keys, or model artifacts from the host filesystem via agent tool invocation, or installs a backdoor — with no trace of the real command in the approval audit log.

AML.T0086

Skill Delivery

Adversary publishes a malicious skill to OpenClaw's community hub or compromises an existing trusted skill, embedding a crafted system.run invocation with hidden argv payload appended after the inline shell command.

AML.T0011.002

Approval Masquerade

When the skill executes, system.run displays benign approval text such as 'checking network status' while the actual malicious command is concealed in trailing positional arguments that bypass display context validation.

AML.T0074

User-Approved Execution

The user or automated orchestrator approves the innocuous-looking request; the shell wrapper executes the hidden command with the agent's full process privileges.

AML.T0050

Exfiltration or Persistence

The injected command exfiltrates credentials, API keys, or model artifacts from the host filesystem via agent tool invocation, or installs a backdoor — with no trace of the real command in the approval audit log.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.4 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to ≥ 2026.2.24 (patches in commits 0f0a680 and 55cf925 per vendor advisory GHSA-6rcp-vxwf-3mfp).
Workaround: If patching is blocked, disable the system.run tool entirely in OpenClaw agent configurations, or restrict it to a server-side allowlist of pre-approved command patterns with independent validation.
Least privilege: Ensure OpenClaw processes run under restricted OS accounts without sudo or elevated shell access.
Detection: Monitor for unexpected child-process spawning from OpenClaw parent processes; alert on shell invocations where the executed command string does not match the user-visible approval text.
Skill hygiene: Audit third-party skill sources and reject skills from unverified publishers, particularly those invoking system.run.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Social Engineering Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.002 - Poisoned AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.6 - Security of AI system tools and capabilities

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain value of deployed AI systems

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32052?

CVE-2026-32052 is a command injection flaw in OpenClaw's system.run shell wrapper that allows an attacker to embed hidden commands as trailing positional argv arguments — arguments that execute silently while the displayed approval prompt shows entirely different, benign-looking text. This deceptive bypass is especially dangerous in AI agent deployments, where operators rely on displayed tool-call context to authorize actions, effectively weaponizing the human-in-the-loop as part of the exploit chain. Although CVSS is a moderate 6.4 and CISA KEV has not flagged active exploitation, EPSS places this in the top 45% for likely exploitation, and OpenClaw's own incident history — AIID #1368 documented credential theft via malicious skills in the same ecosystem earlier this year — confirms this package is already a high-value target. Upgrade to OpenClaw ≥ 2026.2.24 immediately; if patching is blocked, disable or restrict the system.run executor and audit process-spawn logs from OpenClaw worker processes.

Is CVE-2026-32052 actively exploited?

No confirmed active exploitation of CVE-2026-32052 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32052?

1. Patch: Upgrade OpenClaw to ≥ 2026.2.24 (patches in commits 0f0a680 and 55cf925 per vendor advisory GHSA-6rcp-vxwf-3mfp). 2. Workaround: If patching is blocked, disable the system.run tool entirely in OpenClaw agent configurations, or restrict it to a server-side allowlist of pre-approved command patterns with independent validation. 3. Least privilege: Ensure OpenClaw processes run under restricted OS accounts without sudo or elevated shell access. 4. Detection: Monitor for unexpected child-process spawning from OpenClaw parent processes; alert on shell invocations where the executed command string does not match the user-visible approval text. 5. Skill hygiene: Audit third-party skill sources and reject skills from unverified publishers, particularly those invoking system.run.

What systems are affected by CVE-2026-32052?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, agentic pipelines with shell tool access, multi-agent orchestration systems using OpenClaw, local workstation AI assistants with host access.

What is the CVSS score for CVE-2026-32052?

CVE-2026-32052 has a CVSS v3.1 base score of 6.4 (MEDIUM). The EPSS exploitation probability is 0.91%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksagentic pipelines with shell tool accessmulti-agent orchestration systems using OpenClawlocal workstation AI assistants with host access

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.002 Poisoned AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positional argv carriers after inline shell payloads. Attackers can craft misleading approval text while executing arbitrary commands through trailing positional arguments that bypass display context validation.

Exploitation Scenario

An adversary publishes a malicious skill to OpenClaw's community hub — mirroring the AIID #1368 pattern — embedding a crafted system.run invocation that displays 'checking network connectivity' in the approval UI while trailing positional argv arguments silently pass a reverse shell command to the shell interpreter. A developer using the skill inside an agentic pipeline approves the benign-looking action. The hidden command executes with the agent's process privileges, exfiltrating API keys, SSH keys, or model artifacts from the host filesystem, or establishing a persistent backdoor. Because the approval log records only the displayed text, forensic review shows no anomaly.

Weaknesses (CWE)

CWE-436 Interpretation Conflict

CWE-436 — Interpretation Conflict: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE corpus.