CVE-2026-32058: OpenClaw approval bypass enables

CISO Take

OpenClaw's approval mechanism — designed to enforce human sign-off before system.run host=node executions — can be bypassed by replaying a previously valid approval ID with modified environment variables, because the framework binds approval to request identity rather than full execution context (CWE-863 Incorrect Authorization). Despite a CVSS of 2.6, the EPSS score places this in the top 91% for exploitation likelihood, and any deployment relying on approval gates as a primary safety control for AI agent execution should treat this as a control-integrity failure, not a low-severity nuisance. With 396 total CVEs catalogued across the OpenClaw package ecosystem and a real-world incident (AIID #1368) already documenting abuse of the OpenClaw skills ecosystem for credential theft, the aggregate risk profile exceeds what the individual CVSS score communicates. Patch to OpenClaw ≥2026.2.26 immediately; if patching is delayed, enforce single-use approval ID invalidation at the infrastructure layer and audit existing approval logs for reuse patterns.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Rated Low by CVSS (2.6) due to high attack complexity, required user interaction, and limited integrity-only impact, but this understates risk in AI agent contexts. Approval gates are a primary human-in-the-loop safety control in agentic pipelines; bypassing them is a categorical control failure regardless of CVSS scoring. EPSS top 91% indicates meaningful adversary interest. Attack complexity is genuinely high — the attacker needs a valid approval ID and the ability to replay it with modified parameters — but in multi-tenant or team deployments of OpenClaw, approval IDs may be observable by co-workers or via logs. Blast radius is currently limited to 4 downstream dependents, but the OpenClaw ecosystem's prior abuse (AIID #1368) suggests active adversary familiarity with the platform.

How does the attack unfold?

Approval ID Capture

Attacker with low-privilege access to the OpenClaw deployment observes or intercepts a valid approval ID from a recently completed system.run host=node execution via logs, API responses, or network monitoring.

AML.T0037

Context Manipulation

Attacker replays the captured approval ID in a new system.run request with substituted environment variables (e.g., redirected API endpoints, altered file paths, injected credentials) that the original approver never reviewed.

AML.T0080

Authorization Bypass

OpenClaw validates the approval ID as legitimate (CWE-863) but does not verify that the execution context matches the originally approved parameters, allowing the modified request to pass the approval gate.

AML.T0107

Unauthorized Agent Execution

The AI agent executes system.run with adversary-controlled environment variables under the authority of the stolen approval, potentially redirecting outputs to attacker infrastructure or accessing unintended resources while audit logs show an approved action.

AML.T0053

Approval ID Capture

Attacker with low-privilege access to the OpenClaw deployment observes or intercepts a valid approval ID from a recently completed system.run host=node execution via logs, API responses, or network monitoring.

AML.T0037

Context Manipulation

Attacker replays the captured approval ID in a new system.run request with substituted environment variables (e.g., redirected API endpoints, altered file paths, injected credentials) that the original approver never reviewed.

AML.T0080

Authorization Bypass

OpenClaw validates the approval ID as legitimate (CWE-863) but does not verify that the execution context matches the originally approved parameters, allowing the modified request to pass the approval gate.

AML.T0107

Unauthorized Agent Execution

The AI agent executes system.run with adversary-controlled environment variables under the authority of the stolen approval, potentially redirecting outputs to attacker infrastructure or accessing unintended resources while audit logs show an approved action.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

2.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C None

I Low

A None

What should I do?

1 step

1) Upgrade to OpenClaw ≥2026.2.26 (patch commit 10481097f8e6dd0346db9be0b5f27570e1bdfcfa). 2) If upgrade is not immediately possible, implement single-use approval ID enforcement at the infrastructure or middleware layer — approval IDs must be invalidated after first consumption. 3) Audit approval logs for cases where the same approval ID appears with differing environment variable payloads; any such occurrence should be treated as a potential exploitation event. 4) Restrict host=node execution paths to a hardened allowlist of environment variable keys and acceptable value patterns. 5) Review your incident response runbook to include AI agent approval bypass as a detection category, and forward system.run audit events to your SIEM.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human oversight

ISO 42001

8.4 - Human oversight of AI systems

NIST AI RMF

GOVERN 2.2 - Roles and responsibilities for AI risk management

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32058?

OpenClaw's approval mechanism — designed to enforce human sign-off before system.run host=node executions — can be bypassed by replaying a previously valid approval ID with modified environment variables, because the framework binds approval to request identity rather than full execution context (CWE-863 Incorrect Authorization). Despite a CVSS of 2.6, the EPSS score places this in the top 91% for exploitation likelihood, and any deployment relying on approval gates as a primary safety control for AI agent execution should treat this as a control-integrity failure, not a low-severity nuisance. With 396 total CVEs catalogued across the OpenClaw package ecosystem and a real-world incident (AIID #1368) already documenting abuse of the OpenClaw skills ecosystem for credential theft, the aggregate risk profile exceeds what the individual CVSS score communicates. Patch to OpenClaw ≥2026.2.26 immediately; if patching is delayed, enforce single-use approval ID invalidation at the infrastructure layer and audit existing approval logs for reuse patterns.

Is CVE-2026-32058 actively exploited?

No confirmed active exploitation of CVE-2026-32058 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32058?

1) Upgrade to OpenClaw ≥2026.2.26 (patch commit 10481097f8e6dd0346db9be0b5f27570e1bdfcfa). 2) If upgrade is not immediately possible, implement single-use approval ID enforcement at the infrastructure or middleware layer — approval IDs must be invalidated after first consumption. 3) Audit approval logs for cases where the same approval ID appears with differing environment variable payloads; any such occurrence should be treated as a potential exploitation event. 4) Restrict host=node execution paths to a hardened allowlist of environment variable keys and acceptable value patterns. 5) Review your incident response runbook to include AI agent approval bypass as a detection category, and forward system.run audit events to your SIEM.

What systems are affected by CVE-2026-32058?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent workflows, human-in-the-loop pipelines, agentic automation pipelines.

What is the CVSS score for CVE-2026-32058?

CVE-2026-32058 has a CVSS v3.1 base score of 2.6 (LOW). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent workflowshuman-in-the-loop pipelinesagentic automation pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: 8.4

NIST AI RMF: GOVERN 2.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.

Exploitation Scenario

An attacker with low-privilege access to an OpenClaw deployment — for example, a developer on a shared team or a compromised service account — monitors logs or network traffic to capture a valid approval ID from a recently approved system.run host=node execution. The attacker then crafts a replay request using that approval ID but substitutes the environment variables: changing an API_ENDPOINT variable from the legitimate internal service to an attacker-controlled server, or changing a FILE_PATH variable to target sensitive configuration files. Because OpenClaw validates the approval ID but does not verify that the execution context (env vars) matches the original approved context, the system proceeds with execution under the attacker-supplied parameters. The agent completes the operation — potentially exfiltrating data to the attacker's endpoint or writing to unintended paths — while audit trails show an 'approved' action, masking the unauthorized modification.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.