CVE-2026-32016: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32016 is a path validation bypass vulnerability in OpenClaw (npm package) on macOS that allows local attackers to execute unauthorized binaries by exploiting basename-only allowlist entries in the exec-approval allowlist mode. It affects OpenClaw versions prior to 2026.2.22 (specifically ≤2026.2.21-2) running on macOS node-host. The vulnerability was published on March 19, 2026, with a patch committed on the same date. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, Feedly).

The root cause is an untrusted search path issue (CWE-426) combined with incorrect authorization (CWE-863): the ExecAllowlistMatcher in OpenClaw's macOS node-host previously matched allowlist entries by basename alone (e.g., echo) rather than requiring a full path. When security=allowlist and ask=on-miss are configured, an attacker could place a malicious binary named identically to an allowlisted command (e.g., ./echo in a local directory) and execute it without triggering an approval prompt, because the basename match would satisfy the allowlist check. The fix, committed in dd41fad, removes the basename fallback from ExecAllowlistMatcher.swift and enforces path-only pattern matching — requiring allowlist entries to contain /, ~, or \ — while also migrating legacy basename entries to their last-resolved full paths (GitHub Commit, GitHub Advisory). This vulnerability maps to MITRE ATT&CK technique T1574.007 (Path Interception by PATH Environment Variable) and CAPEC-38 (Feedly).

A local attacker with low-privilege access can bypass OpenClaw's exec-approval security policy and execute arbitrary unauthorized binaries without user approval, resulting in high impact to confidentiality, integrity, and availability of the affected macOS system. By placing a same-named binary in an accessible directory and invoking it with a relative path (e.g., ./echo), the attacker can achieve arbitrary code execution under the context of the OpenClaw process. This could facilitate privilege escalation, data exfiltration, or persistence on the affected host (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. Exploitation requires local access and a non-default configuration (security=allowlist with ask=on-miss), significantly limiting the attack surface — the default install posture uses security=deny and is unaffected (GitHub Advisory).

1. Identify vulnerable configuration: Confirm the target macOS system is running OpenClaw ≤2026.2.21-2 with security=allowlist and ask=on-miss configured in the exec-approval settings.
2. Enumerate allowlisted basenames: Review the OpenClaw exec-approval allowlist for basename-only entries (e.g., echo, sort, rg) that lack a full path prefix.
3. Create a malicious binary: Craft a malicious executable with the same name as an allowlisted basename entry (e.g., echo) and place it in a directory accessible to the attacker (e.g., /tmp/oc-basename/echo or a writable local directory).
4. Invoke via relative path: Execute the malicious binary using a relative path (e.g., ./echo) from the directory where it was placed. OpenClaw's basename-only matching will match the allowlist entry and permit execution without prompting for approval.
5. Achieve code execution: The malicious binary runs under the OpenClaw process context without user approval, enabling arbitrary code execution, data access, or further lateral movement (GitHub Advisory, GitHub Commit).

• File System: Unexpected executables with common system command names (e.g., echo, sort, rg) placed in non-standard or writable directories such as /tmp/, /var/folders/, or user home subdirectories.
• Process: Unusual child processes spawned by the OpenClaw node-host process originating from relative or non-standard paths (e.g., /tmp/oc-basename/echo) rather than system binary directories (/bin/, /usr/bin/, /opt/homebrew/bin/).
• Logs: OpenClaw exec-approval logs showing binary executions approved via allowlist match for commands invoked with relative paths (./echo) rather than absolute paths; absence of approval prompts for commands that should have triggered them under ask=on-miss.

The primary remediation is to upgrade OpenClaw to version 2026.2.22 or later, which enforces path-only allowlist matching and removes the basename fallback (GitHub Commit, GitHub Advisory). As an interim workaround, administrators should review and update all exec-approval allowlist entries to use full absolute paths (containing /) rather than basename-only entries. Additionally, restricting local user access to systems running OpenClaw with non-default allowlist configurations and monitoring for suspicious binary execution attempts are recommended defensive measures (Feedly).

The vulnerability was reported by researcher tdjackey and acknowledged by the OpenClaw maintainer (steipete) in the GitHub security advisory (GitHub Advisory). VulnCheck assigned the CVE and published an advisory noting the path traversal via basename-only allowlist matching on macOS. Community coverage has been limited to automated CVE alert aggregators such as RedPacket Security and VulDB, with no significant broader media or researcher commentary observed.