CVE-2026-32978: OpenClaw script approval bypass

CISO Take

OpenClaw's system.run authorization mechanism binds approvals to a script's path rather than its content, creating a TOCTOU window where an attacker with low-privilege access can get a benign script approved, overwrite it on disk with a malicious payload, and execute arbitrary code under the already-granted authorization — particularly effective against tsx and jiti runners. The CVSS 8.0 with Changed scope means a successful exploit doesn't stop at the agent boundary: confidentiality, integrity, and availability are all rated High at the host level, putting credentials, pipeline outputs, and system access at risk. EPSS places this in the top 92nd percentile for exploitation likelihood, and AIID incident #1368 confirms real-world attacker motivation to abuse OpenClaw's execution mechanisms for credential theft — meaning the threat model is not hypothetical. Patch to OpenClaw 2026.3.11 immediately; if patching is not feasible, disable tsx and jiti runners and implement file-integrity monitoring on all paths subject to system.run approval workflows.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High operational risk for organizations running OpenClaw-based AI agent workflows. While High attack complexity and Required user interaction nominally constrain exploitability, agentic environments frequently normalize repeated, semi-automated approvals — effectively removing the human-review barrier the CVSS model assumes. The Changed scope is the critical amplifier: exploitation escapes the agent process and reaches the host, making this more dangerous than the 8.0 score alone conveys. No public exploit or scanner template exists yet, providing a narrow mitigation window before the complexity floor drops. The 396 other CVEs in the OpenClaw package indicate a historically high-vulnerability component warranting elevated scrutiny regardless of this specific issue.

How does the attack unfold?

Reconnaissance

Attacker identifies an OpenClaw deployment using tsx or jiti script runners and discovers writable script directories subject to system.run approval workflows.

AML.T0084

Approval Solicitation

Attacker submits a benign, human-inspectable script and obtains a system.run authorization bound to the script path rather than its content hash.

AML.T0011

Script Poisoning

Before or within the execution window, attacker overwrites the approved script on disk with a malicious payload targeting credentials, environment variables, or pipeline data.

AML.T0110

Execution and Exfiltration

OpenClaw executes the malicious script under the previously granted approval context with Changed scope, achieving host-level RCE and enabling credential exfiltration or persistent access.

AML.T0053

Reconnaissance

Attacker identifies an OpenClaw deployment using tsx or jiti script runners and discovers writable script directories subject to system.run approval workflows.

AML.T0084

Approval Solicitation

Attacker submits a benign, human-inspectable script and obtains a system.run authorization bound to the script path rather than its content hash.

AML.T0011

Script Poisoning

Before or within the execution window, attacker overwrites the approved script on disk with a malicious payload targeting credentials, environment variables, or pipeline data.

AML.T0110

Execution and Exfiltration

OpenClaw executes the malicious script under the previously granted approval context with Changed scope, achieving host-level RCE and enabling credential exfiltration or persistent access.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Changed

C High

I High

A High

What should I do?

7 steps

Patch OpenClaw to version 2026.3.11 or later — this is the only full remediation.
Until patched, disable tsx and jiti script runners in OpenClaw configuration.
Deploy file-integrity monitoring (FIM) on all directories containing scripts eligible for system.run approval; alert on any modification after approval timestamp.
Restrict write permissions on approved script directories to privileged service accounts only, removing write access from the principals who typically submit approval requests.
Audit all currently active approved-run contexts: compare script file hashes against the state at approval time.
In orchestrated environments, implement a compensating control that binds approvals to a content hash (SHA-256) in addition to the file path.
Review GHSA-qc36-x95h-7j53 and the VulnCheck advisory for any updated exploitation indicators.

How is it classified?

Auth Bypass Code Execution Supply Chain Agent Plugin AML.T0011 - User Execution AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

8.4 - AI System Security

NIST AI RMF

GOVERN 1.2 - Organizational Risk Tolerance and Risk Management

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32978?

OpenClaw's system.run authorization mechanism binds approvals to a script's path rather than its content, creating a TOCTOU window where an attacker with low-privilege access can get a benign script approved, overwrite it on disk with a malicious payload, and execute arbitrary code under the already-granted authorization — particularly effective against tsx and jiti runners. The CVSS 8.0 with Changed scope means a successful exploit doesn't stop at the agent boundary: confidentiality, integrity, and availability are all rated High at the host level, putting credentials, pipeline outputs, and system access at risk. EPSS places this in the top 92nd percentile for exploitation likelihood, and AIID incident #1368 confirms real-world attacker motivation to abuse OpenClaw's execution mechanisms for credential theft — meaning the threat model is not hypothetical. Patch to OpenClaw 2026.3.11 immediately; if patching is not feasible, disable tsx and jiti runners and implement file-integrity monitoring on all paths subject to system.run approval workflows.

Is CVE-2026-32978 actively exploited?

No confirmed active exploitation of CVE-2026-32978 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32978?

1. Patch OpenClaw to version 2026.3.11 or later — this is the only full remediation. 2. Until patched, disable tsx and jiti script runners in OpenClaw configuration. 3. Deploy file-integrity monitoring (FIM) on all directories containing scripts eligible for system.run approval; alert on any modification after approval timestamp. 4. Restrict write permissions on approved script directories to privileged service accounts only, removing write access from the principals who typically submit approval requests. 5. Audit all currently active approved-run contexts: compare script file hashes against the state at approval time. 6. In orchestrated environments, implement a compensating control that binds approvals to a content hash (SHA-256) in addition to the file path. 7. Review GHSA-qc36-x95h-7j53 and the VulnCheck advisory for any updated exploitation indicators.

What systems are affected by CVE-2026-32978?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Agentic orchestration pipelines, Multi-agent systems, Code execution pipelines, Tool-augmented LLM workflows.

What is the CVSS score for CVE-2026-32978?

CVE-2026-32978 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksAgentic orchestration pipelinesMulti-agent systemsCode execution pipelinesTool-augmented LLM workflows

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.

Exploitation Scenario

An attacker with low-privilege access to an OpenClaw deployment writes a benign, human-readable tsx data-transformation script to a shared or writable path and requests a system.run approval through a legitimate interface. A developer or automated CI pipeline grants approval — binding authorization to the script path, not its content hash. The attacker then overwrites the script file with a payload that dumps environment variables (including LLM API keys and database connection strings) and POSTs them to an attacker-controlled endpoint. When OpenClaw executes the approved system.run command — triggered automatically or by the next pipeline invocation — it runs the malicious payload under the granted approval context. The Changed scope allows the attacker to escape the agent sandbox, achieving host-level credential exfiltration consistent with the AMOS Stealer abuse documented in AIID #1368.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.