CVE-2026-32971: OpenClaw approval UI spoofing enables

CISO Take

OpenClaw's node-host system.run approval mechanism displays a misleading shell payload to operators rather than the actual command argv that will be executed, creating a UI integrity gap that allows attackers to induce arbitrary code execution through operator-approved but deceptive commands. With 396 prior CVEs in the same package and the OpenClaw ecosystem already directly implicated in credential stealer distribution (AIID #1368, Feb 2026), this approval bypass is particularly dangerous for organizations running OpenClaw agents with operator-in-the-loop workflows. Despite no public exploit, the EPSS places this in the top 81% of exploitation likelihood — reflecting active threat actor interest in the OpenClaw ecosystem broadly. Immediately upgrade to OpenClaw 2026.3.11 or later, and if patching is delayed, disable system.run approvals entirely and audit PATH-accessible directories for unexpected wrapper binaries.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 7.1 High with a network-accessible attack path and full confidentiality/integrity/availability impact, partially offset by high attack complexity and required operator interaction. The critical contextual risk factor is that this vulnerability defeats the AI agent's primary human safety gate: the approval workflow is the control organizations rely on to prevent unauthorized agentic code execution, and this CVE subverts it entirely without triggering any visible alarm. EPSS top 81st percentile — despite no public exploit — combined with documented active abuse of the OpenClaw ecosystem elevates practical exploitation risk well above what the CVSS baseline suggests. Organizations using OpenClaw in production with broad agent permissions (filesystem, network, credential stores) face a materially degraded security posture until patched.

How does the attack unfold?

Wrapper Staging

Attacker places a wrapper binary in a PATH-accessible directory on the target system, naming it to shadow a legitimate tool the OpenClaw agent is expected to invoke (e.g., python, git, curl).

AML.T0079

Approval UI Deception

Attacker induces the OpenClaw agent to execute a system.run command invoking the wrapper binary; the approval dialog displays a benign-looking extracted shell payload rather than the actual argv, deceiving the reviewing operator.

AML.T0074

Operator Approval

The operator reviews the misleading approval display, judges the command safe, and approves — unknowingly authorizing execution of the malicious wrapper binary.

AML.T0011

Code Execution and Exfiltration

OpenClaw executes the actual argv pointing to the wrapper binary, achieving arbitrary local code execution — typically credential theft, reverse shell establishment, or persistence — while the wrapper optionally runs the legitimate command to avoid post-hoc detection.

AML.T0112.000

Wrapper Staging

Attacker places a wrapper binary in a PATH-accessible directory on the target system, naming it to shadow a legitimate tool the OpenClaw agent is expected to invoke (e.g., python, git, curl).

AML.T0079

Approval UI Deception

Attacker induces the OpenClaw agent to execute a system.run command invoking the wrapper binary; the approval dialog displays a benign-looking extracted shell payload rather than the actual argv, deceiving the reviewing operator.

AML.T0074

Operator Approval

The operator reviews the misleading approval display, judges the command safe, and approves — unknowingly authorizing execution of the malicious wrapper binary.

AML.T0011

Code Execution and Exfiltration

OpenClaw executes the actual argv pointing to the wrapper binary, achieving arbitrary local code execution — typically credential theft, reverse shell establishment, or persistence — while the wrapper optionally runs the legitimate command to avoid post-hoc detection.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately: Upgrade to OpenClaw >= 2026.3.11 — the only complete fix.
If patching is delayed: disable system.run approvals entirely and restrict the feature via configuration; alternatively, run OpenClaw in an isolated sandbox (container, restricted user, no writable PATH directories).
Detection: Audit all PATH-accessible directories for unexpected wrapper scripts or binaries that proxy to other executables; check for binaries shadowing common tools (git, python, node, curl) with recent modification timestamps.
Threat hunt: If OpenClaw has had access to credential stores, cross-reference with AIID #1368 IOCs (AMOS stealer) to rule out prior compromise.
Inventory: Identify all OpenClaw deployments via pip list or dependency scans across your environment before declaring containment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Social Engineering Agent AML.T0011 - User Execution AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human oversight

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

GOVERN 1.1 - Policies, processes, procedures, and practices governing AI risk

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32971?

OpenClaw's node-host system.run approval mechanism displays a misleading shell payload to operators rather than the actual command argv that will be executed, creating a UI integrity gap that allows attackers to induce arbitrary code execution through operator-approved but deceptive commands. With 396 prior CVEs in the same package and the OpenClaw ecosystem already directly implicated in credential stealer distribution (AIID #1368, Feb 2026), this approval bypass is particularly dangerous for organizations running OpenClaw agents with operator-in-the-loop workflows. Despite no public exploit, the EPSS places this in the top 81% of exploitation likelihood — reflecting active threat actor interest in the OpenClaw ecosystem broadly. Immediately upgrade to OpenClaw 2026.3.11 or later, and if patching is delayed, disable system.run approvals entirely and audit PATH-accessible directories for unexpected wrapper binaries.

Is CVE-2026-32971 actively exploited?

No confirmed active exploitation of CVE-2026-32971 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32971?

1. Patch immediately: Upgrade to OpenClaw >= 2026.3.11 — the only complete fix. 2. If patching is delayed: disable system.run approvals entirely and restrict the feature via configuration; alternatively, run OpenClaw in an isolated sandbox (container, restricted user, no writable PATH directories). 3. Detection: Audit all PATH-accessible directories for unexpected wrapper scripts or binaries that proxy to other executables; check for binaries shadowing common tools (git, python, node, curl) with recent modification timestamps. 4. Threat hunt: If OpenClaw has had access to credential stores, cross-reference with AIID #1368 IOCs (AMOS stealer) to rule out prior compromise. 5. Inventory: Identify all OpenClaw deployments via pip list or dependency scans across your environment before declaring containment.

What systems are affected by CVE-2026-32971?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Human-in-the-loop agent workflows, Agentic automation pipelines, Local AI agent deployments.

What is the CVSS score for CVE-2026-32971?

CVE-2026-32971 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksHuman-in-the-loop agent workflowsAgentic automation pipelinesLocal AI agent deployments

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attackers can place wrapper binaries and induce wrapper-shaped commands to execute local code after operators approve misleading command text.

Exploitation Scenario

An attacker with low-privilege access to a host running an OpenClaw agent drops a wrapper binary named 'python' into a user-writable directory that appears early in the agent's PATH. The wrapper executes the attacker's payload (e.g., exfiltrating ~/.ssh keys or spawning a reverse shell) then immediately chains to the real Python interpreter, completing the legitimate operation without visible failure. The attacker then crafts or intercepts an agent task that triggers a system.run invocation of 'python script.py'. When the approval dialog fires, the operator sees a displayed shell payload showing a benign Python script invocation — but the argv OpenClaw actually executes points to the wrapper binary. The operator approves. Code execution is achieved under the agent's identity, with the legitimate script also completing normally to avoid suspicion. Given the AIID #1368 precedent of AMOS stealer delivery through OpenClaw skills, the most likely attacker objective is credential exfiltration.

Weaknesses (CWE)

CWE-451 User Interface (UI) Misrepresentation of Critical Information

CWE-451 — User Interface (UI) Misrepresentation of Critical Information: The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

[Implementation] Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
[Architecture and Design] Create a strategy for presenting information, and plan for how to display unusual characters.

Source: MITRE CWE corpus.