CVE-2026-32921: OpenClaw script approval bypass

CISO Take

OpenClaw's system.run tool contains a Time-of-Check Time-of-Use (TOCTOU) flaw where script files are not immutably bound between the approval and execution phases, allowing a low-privileged network attacker to substitute malicious content after gaining approval for a benign script. While CVSS scores this as medium (6.3), this CVE lands in the top 90th EPSS percentile, and the OpenClaw skills ecosystem already has a confirmed real-world abuse incident (AIID #1368) involving credential theft via malicious skills in the same framework — the approval gate was the primary trust boundary being circumvented there too. Any AI agent deployment running OpenClaw with human-in-the-loop approval workflows is exposed, with 4 known downstream dependents at risk of inheriting the flaw. Upgrade to OpenClaw 2026.3.8 (patches c76d292 and cf3a479) immediately; as an interim control, restrict filesystem write access to script staging directories after submission and implement SHA-256 hash verification immediately before execution to detect divergence.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium-severity by CVSS, but contextually elevated for AI agent deployments. Low attack complexity and minimal privilege requirement (PR:L, AC:L) mean the exploitation bar is low — any authenticated platform user can attempt it with no user interaction required. The top-90 EPSS placement signals meaningful real-world exploitation risk relative to the broader CVE population. The 396 other CVEs in the same package suggest a historically under-secured codebase. Critically, this vulnerability defeats human-in-the-loop controls — a mechanism frequently cited in AI governance frameworks as the primary safeguard against unsanctioned agent behavior. Organizations enforcing approval workflows as an ISO 42001 or EU AI Act Article 14 compliance control face integrity risk: that control is bypassed by this flaw.

How does the attack unfold?

Approval Submission

Low-privileged attacker submits a benign script via OpenClaw's system.run tool, obtaining legitimate approval from an admin reviewer or automated governance gate.

AML.T0053

Script Substitution

In the window between approval and execution, attacker overwrites the approved script file with a malicious payload such as a credential harvester or reverse shell.

AML.T0110

Defense Evasion

OpenClaw executes the malicious content while audit logs capture only the approved benign command shape, hiding true execution from human reviewers and compliance audit trails.

AML.T0107

Impact

Attacker achieves arbitrary code execution under the agent's runtime privileges, enabling data exfiltration, lateral movement to connected tools, or persistent backdoor installation.

AML.T0050

Approval Submission

Low-privileged attacker submits a benign script via OpenClaw's system.run tool, obtaining legitimate approval from an admin reviewer or automated governance gate.

AML.T0053

Script Substitution

In the window between approval and execution, attacker overwrites the approved script file with a malicious payload such as a credential harvester or reverse shell.

AML.T0110

Defense Evasion

OpenClaw executes the malicious content while audit logs capture only the approved benign command shape, hiding true execution from human reviewers and compliance audit trails.

AML.T0107

Impact

Attacker achieves arbitrary code execution under the agent's runtime privileges, enabling data exfiltration, lateral movement to connected tools, or persistent backdoor installation.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to version 2026.3.8 (commits c76d29208b and cf3a479bd1 both required per vendor advisory GHSA-8g75-q649-6pv6).
Interim workaround: enforce read-only permissions on script staging directories after submission and before execution; prevent any process other than the submission handler from writing to the path.
Detection: compute and store SHA-256 hashes of script files at approval time; verify hash immediately before execution and abort with an alert on any divergence.
Audit: review system.run invocations in agent logs for timestamp anomalies between approval and execution events, and cross-reference approved command shapes against actual executed content where logging captures both.
Access control: apply principle of least privilege to the agent runtime — restrict which filesystem paths and network resources system.run can reach.
Architecture review: audit any other tools in your AI agent stack that implement approve-then-execute patterns without immutable binding.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human oversight Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system operation

NIST AI RMF

MANAGE-2.4 - Residual risks and mitigation plans are documented and tracked

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32921?

OpenClaw's system.run tool contains a Time-of-Check Time-of-Use (TOCTOU) flaw where script files are not immutably bound between the approval and execution phases, allowing a low-privileged network attacker to substitute malicious content after gaining approval for a benign script. While CVSS scores this as medium (6.3), this CVE lands in the top 90th EPSS percentile, and the OpenClaw skills ecosystem already has a confirmed real-world abuse incident (AIID #1368) involving credential theft via malicious skills in the same framework — the approval gate was the primary trust boundary being circumvented there too. Any AI agent deployment running OpenClaw with human-in-the-loop approval workflows is exposed, with 4 known downstream dependents at risk of inheriting the flaw. Upgrade to OpenClaw 2026.3.8 (patches c76d292 and cf3a479) immediately; as an interim control, restrict filesystem write access to script staging directories after submission and implement SHA-256 hash verification immediately before execution to detect divergence.

Is CVE-2026-32921 actively exploited?

No confirmed active exploitation of CVE-2026-32921 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32921?

1. Patch immediately: upgrade OpenClaw to version 2026.3.8 (commits c76d29208b and cf3a479bd1 both required per vendor advisory GHSA-8g75-q649-6pv6). 2. Interim workaround: enforce read-only permissions on script staging directories after submission and before execution; prevent any process other than the submission handler from writing to the path. 3. Detection: compute and store SHA-256 hashes of script files at approval time; verify hash immediately before execution and abort with an alert on any divergence. 4. Audit: review system.run invocations in agent logs for timestamp anomalies between approval and execution events, and cross-reference approved command shapes against actual executed content where logging captures both. 5. Access control: apply principle of least privilege to the agent runtime — restrict which filesystem paths and network resources system.run can reach. 6. Architecture review: audit any other tools in your AI agent stack that implement approve-then-execute patterns without immutable binding.

What systems are affected by CVE-2026-32921?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, human-in-the-loop approval workflows, AI agent orchestration pipelines.

What is the CVSS score for CVE-2026-32921?

CVE-2026-32921 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworkshuman-in-the-loop approval workflowsAI agent orchestration pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 14, Article 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.

Exploitation Scenario

An insider threat or compromised low-privilege account with access to an OpenClaw-based AI agent system submits a benign script via system.run — for example, a routine log cleanup job — and obtains approval from an admin or automated governance gate. In the window between approval confirmation and actual execution (which may be milliseconds in automated pipelines or minutes in manual review flows), the attacker overwrites the approved script file on the shared filesystem with a payload that exfiltrates environment variables, harvests API keys stored in the agent's configuration, or drops a reverse shell. OpenClaw executes the malicious payload under its runtime privileges, which in agentic deployments typically include network egress, file system access, and integration with downstream tools. The approval audit trail records only the benign command shape that was reviewed, making post-incident forensics ambiguous and potentially obscuring the breach from compliance auditors.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.