CVE-2026-32065: OpenClaw approval bypass enables

CISO Take

OpenClaw's system.run approval mechanism contains a rendering-vs-execution integrity gap: the framework trims whitespace from the executable token when displaying it to the approver, but passes the raw argv — including trailing spaces — to the OS at runtime, allowing an attacker to stage a different binary under a trailing-space filename that resolves to a wholly different executable than what was reviewed and approved. The CVSS sits at 4.8 (Medium) due to high attack complexity and required user interaction, but the EPSS placing this in the top 80th percentile of likely-exploited CVEs is meaningful, and AIID #1368 already documents active credential-theft abuse within the OpenClaw skills ecosystem — an attacker exploiting this bypass could deliver the same payload class without needing a malicious skill at all. In enterprise environments where system.run approvals are a trust boundary gating infrastructure or API access, this vulnerability directly undermines that control. Patch to OpenClaw 2026.2.25 (commit 03e689fc) immediately; until then, restrict who can influence command argv, run OpenClaw under a least-privilege service account, and audit approval logs for executable tokens where raw argv differs from the trimmed display value.

Sources: NVD EPSS GitHub Advisory ATLAS github.com/openclaw vulncheck.com AIID

What is the risk?

The Medium CVSS (4.8) underweights the operational risk in AI agent deployments where system.run approval is a primary security control. Network-accessible attack vector with low privilege requirement means any authenticated user or compromised account can attempt exploitation. The high attack complexity reflects the need to both pre-stage a trailing-space binary in a PATH-accessible writable directory and influence command argv — achievable for an insider or a compromised developer account. No public exploit exists and EPSS raw score is low (0.0029), making opportunistic mass exploitation unlikely short-term. However, the 396 other CVEs in the same package signal chronic security debt, and the package's 4 downstream dependents may inherit exposure. Integrity impact is High (I:H) with no confidentiality or availability component — this is a privilege escalation via deception vector, most dangerous when OpenClaw runs as a service account with access to internal APIs, databases, or cloud credentials.

How does the attack unfold?

Privilege Positioning

Attacker obtains low-privilege access to an OpenClaw deployment (compromised developer account, insider, or valid credentials) and identifies a reusable approval context for system.run targeting a recognized, frequently-approved binary.

AML.T0012

Payload Staging

Attacker writes a malicious binary to a PATH-accessible writable directory (e.g., /tmp) under a filename with a trailing space matching the target approved executable, pre-positioning it for OS resolution ahead of the legitimate binary.

AML.T0079

Approval Deception

Attacker submits a system.run call with the trailing-space executable token; OpenClaw's approval UI renders the trimmed name, which the human approver recognizes as legitimate and grants approval without detecting the discrepancy.

AML.T0074

Unauthorized Execution

OpenClaw runtime passes raw argv to the OS, resolving the trailing-space filename to the attacker's staged binary, which executes under the OpenClaw service account and exfiltrates credentials or pivots to downstream systems.

AML.T0053

Privilege Positioning

Attacker obtains low-privilege access to an OpenClaw deployment (compromised developer account, insider, or valid credentials) and identifies a reusable approval context for system.run targeting a recognized, frequently-approved binary.

AML.T0012

Payload Staging

Attacker writes a malicious binary to a PATH-accessible writable directory (e.g., /tmp) under a filename with a trailing space matching the target approved executable, pre-positioning it for OS resolution ahead of the legitimate binary.

AML.T0079

Approval Deception

Attacker submits a system.run call with the trailing-space executable token; OpenClaw's approval UI renders the trimmed name, which the human approver recognizes as legitimate and grants approval without detecting the discrepancy.

AML.T0074

Unauthorized Execution

OpenClaw runtime passes raw argv to the OS, resolving the trailing-space filename to the attacker's staged binary, which executes under the OpenClaw service account and exfiltrates credentials or pivots to downstream systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C None

I High

A None

What should I do?

6 steps

Patch: upgrade to OpenClaw 2026.2.25 or later (commit 03e689fc is the canonical fix).
If immediate patching is not possible, treat argv as a privileged input — restrict which principals can supply or modify executable tokens in system.run calls.
Audit existing approval logs: scan for argv entries where trim(executable_token) != executable_token (trailing or embedded whitespace); flag for manual review.
Run OpenClaw under a least-privilege service account with a seccomp or AppArmor profile limiting which binaries can be exec'd, reducing blast radius if bypass succeeds.
As a compensating control, add a secondary approval step that renders raw (untrimmed) argv for any system.run call touching sensitive resources.
Monitor filesystem for newly created files with trailing-space names in PATH-accessible writable directories.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation

NIST AI RMF

GOVERN 1.2 - Accountability

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32065?

OpenClaw's system.run approval mechanism contains a rendering-vs-execution integrity gap: the framework trims whitespace from the executable token when displaying it to the approver, but passes the raw argv — including trailing spaces — to the OS at runtime, allowing an attacker to stage a different binary under a trailing-space filename that resolves to a wholly different executable than what was reviewed and approved. The CVSS sits at 4.8 (Medium) due to high attack complexity and required user interaction, but the EPSS placing this in the top 80th percentile of likely-exploited CVEs is meaningful, and AIID #1368 already documents active credential-theft abuse within the OpenClaw skills ecosystem — an attacker exploiting this bypass could deliver the same payload class without needing a malicious skill at all. In enterprise environments where system.run approvals are a trust boundary gating infrastructure or API access, this vulnerability directly undermines that control. Patch to OpenClaw 2026.2.25 (commit 03e689fc) immediately; until then, restrict who can influence command argv, run OpenClaw under a least-privilege service account, and audit approval logs for executable tokens where raw argv differs from the trimmed display value.

Is CVE-2026-32065 actively exploited?

No confirmed active exploitation of CVE-2026-32065 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32065?

1. Patch: upgrade to OpenClaw 2026.2.25 or later (commit 03e689fc is the canonical fix). 2. If immediate patching is not possible, treat argv as a privileged input — restrict which principals can supply or modify executable tokens in system.run calls. 3. Audit existing approval logs: scan for argv entries where trim(executable_token) != executable_token (trailing or embedded whitespace); flag for manual review. 4. Run OpenClaw under a least-privilege service account with a seccomp or AppArmor profile limiting which binaries can be exec'd, reducing blast radius if bypass succeeds. 5. As a compensating control, add a secondary approval step that renders raw (untrimmed) argv for any system.run call touching sensitive resources. 6. Monitor filesystem for newly created files with trailing-space names in PATH-accessible writable directories.

What systems are affected by CVE-2026-32065?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, agentic pipelines with human-in-the-loop approval, multi-agent orchestration.

What is the CVSS score for CVE-2026-32065?

CVE-2026-32065 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentsagentic pipelines with human-in-the-loop approvalmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to execute a different binary than what the approver displayed, allowing unexpected command execution under the OpenClaw runtime user when they can influence command argv and reuse an approval context.

Exploitation Scenario

An attacker with a low-privilege developer account at an organization using OpenClaw as an internal AI assistant identifies that the team regularly approves system.run calls to a legitimate tool (e.g., 'data-export'). The attacker writes a malicious binary to /tmp — a directory writable by the OpenClaw runtime user and present in the PATH — naming it 'data-export ' (with a trailing space). On Linux, this is a valid distinct filename. The attacker then submits a task that triggers system.run with argv ['data-export '] (trailing space). OpenClaw's approval UI trims and renders 'data-export', which an operator recognizes and approves without suspecting anything. OpenClaw runtime resolves 'data-export ' via PATH, finds the attacker's binary in /tmp first, and executes it under the OpenClaw service account — which holds production database credentials and internal API tokens stored in environment variables. The attacker exfiltrates those credentials to an external endpoint, achieving lateral movement to production systems.

Weaknesses (CWE)

CWE-436 Interpretation Conflict

CWE-436 — Interpretation Conflict: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE corpus.