CVE-2026-32973: OpenClaw exec allowlist bypass

CISO Take

OpenClaw's matchesExecAllowlistPattern function contains a critical flaw where path lowercasing combined with overly permissive glob matching—specifically the '?' wildcard crossing POSIX path segment boundaries—allows attackers to execute commands and file paths that operators explicitly intended to block. With a CVSS of 9.8 (network-accessible, no authentication, no user interaction required) and EPSS placing exploitation likelihood in the top 68th percentile, any AI agent deployment using OpenClaw as its execution engine faces full CIA triad exposure; the package's history of 396 prior CVEs signals systemic security debt, and AIID #1368 confirms OpenClaw's execution ecosystem has already been actively targeted for credential theft. Upgrade to OpenClaw 2026.3.11 or later immediately; if patching is blocked, replace all wildcard-containing allowlist entries with absolute, exact path strings and enforce OS-level process isolation (seccomp, AppArmor) as a compensating control.

Sources: NVD EPSS CISA KEV GitHub Advisory VulnCheck ATLAS

What is the risk?

Critical. CVSS 9.8 with all high-impact dimensions: network vector, low complexity, no privileges required, no user interaction. OpenClaw operates as an AI agent execution environment where the allowlist is the primary safety boundary—bypassing it is equivalent to a full sandbox escape. EPSS at the 68th percentile indicates meaningful near-term exploitation probability without KEV confirmation. The combination of a trivially crafted path payload and complete CIA impact makes this one of the higher-priority AI agent vulnerabilities of the quarter.

How does the attack unfold?

Initial Access

Attacker sends a crafted network request to an OpenClaw-enabled application requiring no authentication and no user interaction.

AML.T0049

Defense Evasion

Attacker exploits '?' wildcard cross-segment matching and lowercasing normalization in matchesExecAllowlistPattern to make a blocked command path appear allowlisted.

AML.T0107

Execution

OpenClaw executes the attacker-controlled command or binary that the allowlist was designed to block, achieving remote code execution with the agent's permissions.

AML.T0050

Impact

Attacker achieves full confidentiality, integrity, and availability compromise of the agent's execution environment, enabling credential theft, data exfiltration, or lateral movement into downstream AI infrastructure.

AML.T0053

Initial Access

Attacker sends a crafted network request to an OpenClaw-enabled application requiring no authentication and no user interaction.

AML.T0049

Defense Evasion

Attacker exploits '?' wildcard cross-segment matching and lowercasing normalization in matchesExecAllowlistPattern to make a blocked command path appear allowlisted.

AML.T0107

Execution

OpenClaw executes the attacker-controlled command or binary that the allowlist was designed to block, achieving remote code execution with the agent's permissions.

AML.T0050

Impact

Attacker achieves full confidentiality, integrity, and availability compromise of the agent's execution environment, enabling credential theft, data exfiltration, or lateral movement into downstream AI infrastructure.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade to OpenClaw 2026.3.11 or later per GHSA-f8r2-vg7x-gh8m.
Workaround: Replace all wildcard-containing allowlist patterns with full, absolute, exact path strings; avoid '?' and '*' globs in matchesExecAllowlistPattern entries until patched.
Compensating control: Enforce OS-level process isolation (seccomp, AppArmor, cgroups) to constrain subprocess execution independently of OpenClaw's allowlist logic.
Detection: Audit subprocess execution logs for invocations not matching expected allowlist entries, particularly paths with mixed case or special characters on POSIX systems.
Posture: Given 396 prior CVEs in this package, evaluate OpenClaw's role in your agent architecture and consider alternative execution environments with stronger isolation primitives.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operation

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32973?

OpenClaw's matchesExecAllowlistPattern function contains a critical flaw where path lowercasing combined with overly permissive glob matching—specifically the '?' wildcard crossing POSIX path segment boundaries—allows attackers to execute commands and file paths that operators explicitly intended to block. With a CVSS of 9.8 (network-accessible, no authentication, no user interaction required) and EPSS placing exploitation likelihood in the top 68th percentile, any AI agent deployment using OpenClaw as its execution engine faces full CIA triad exposure; the package's history of 396 prior CVEs signals systemic security debt, and AIID #1368 confirms OpenClaw's execution ecosystem has already been actively targeted for credential theft. Upgrade to OpenClaw 2026.3.11 or later immediately; if patching is blocked, replace all wildcard-containing allowlist entries with absolute, exact path strings and enforce OS-level process isolation (seccomp, AppArmor) as a compensating control.

Is CVE-2026-32973 actively exploited?

No confirmed active exploitation of CVE-2026-32973 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32973?

1. Patch: Upgrade to OpenClaw 2026.3.11 or later per GHSA-f8r2-vg7x-gh8m. 2. Workaround: Replace all wildcard-containing allowlist patterns with full, absolute, exact path strings; avoid '?' and '*' globs in matchesExecAllowlistPattern entries until patched. 3. Compensating control: Enforce OS-level process isolation (seccomp, AppArmor, cgroups) to constrain subprocess execution independently of OpenClaw's allowlist logic. 4. Detection: Audit subprocess execution logs for invocations not matching expected allowlist entries, particularly paths with mixed case or special characters on POSIX systems. 5. Posture: Given 396 prior CVEs in this package, evaluate OpenClaw's role in your agent architecture and consider alternative execution environments with stronger isolation primitives.

What systems are affected by CVE-2026-32973?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic pipelines, AI tool execution environments.

What is the CVSS score for CVE-2026-32973?

CVE-2026-32973 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic pipelinesAI tool execution environments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.

Exploitation Scenario

An adversary targeting an organization running OpenClaw-based AI agents first probes the target's allowlist configuration via agent configuration discovery or behavioral probing. The attacker identifies a command path that is blocked (e.g., '/bin/sh') and a nearby path that is permitted (e.g., '/usr/bin/python3'). Exploiting the '?' wildcard's cross-segment matching combined with lowercasing normalization, the attacker crafts a request with a path such as '/usr/bi?/python3' or a case-manipulated equivalent that resolves to a blocked binary after normalization. The agent executes the unintended command with its own permissions, achieving remote code execution that can pivot to credential theft, data exfiltration, or lateral movement—directly replicating the credential theft attack chain documented in AIID #1368.