CVE-2026-32058: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32058 is an approval context-binding weakness in OpenClaw (npm package) affecting versions prior to 2026.2.26. In system.run execution flows configured with host=node, the approval mechanism failed to enforce strict, versioned execution-context binding, allowing a previously approved request to be reused with modified environment variables. This effectively bypasses execution-integrity controls in approval-enabled workflows. The vulnerability was published on March 21, 2026, and patched in version 2026.2.26. It carries a CVSS v3.1 base score of 6.5 (Medium/High) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Feedly).

The root cause is classified under CWE-863 (Incorrect Authorization) and CWE-15 (External Control of System or Configuration Setting). The vulnerability exists because system.run approvals in host=node workflows did not require a versioned binding (systemRunBindingV1) that ties the approval to a canonicalized set of parameters including command argv, working directory, agent/session context, and an environment variable hash (envHash/envKeys). An attacker who obtains a valid approval ID can replay it with altered env inputs, since the legacy non-versioned fallback matching did not validate environment variable integrity. The fix enforces commandArgv as a required field when requesting approvals and mandates systemRunBindingV1 when consuming them, removes the legacy fallback, and adds GIT_EXTERNAL_DIFF to the blocked host environment key list (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to modify environment variables in an already-approved system.run execution, causing commands to run with parameters that were never reviewed or authorized by the approver. This primarily affects integrity — unauthorized or unintended command configurations can be executed on the host node. Confidentiality and availability impacts are assessed as none to low; the vulnerability does not directly expose data or cause service disruption, but could be leveraged to alter execution behavior in sensitive automated workflows (GitHub Advisory, Feedly).

1. Identify target: Confirm the target OpenClaw instance is running a version prior to 2026.2.26 with system.run configured using host=node and exec approvals enabled as an execution-integrity control.
2. Obtain a valid approval ID: Gain access to a previously issued approval ID within the same workflow context — this may be obtained through legitimate access, log inspection, or interception of approval request metadata.
3. Craft a modified execution request: Construct a system.run invocation that reuses the obtained approval ID but substitutes altered environment variable values (e.g., changing PATH, GIT_EXTERNAL_DIFF, or other env keys that influence command behavior).
4. Submit the replayed approval: Send the modified request to the OpenClaw gateway. Because the legacy non-versioned approval matching does not validate the envHash or envKeys, the system accepts the reused approval despite the changed environment.
5. Achieve unauthorized execution: The command executes on the host node with the attacker-controlled environment variables, bypassing the integrity guardrail that the approval was intended to enforce (GitHub Advisory, Patch Commit).

• Logs: OpenClaw gateway logs showing system.run executions with host=node where the approval ID matches a previously issued approval but environment variable sets differ from the original approved request; repeated approval ID reuse across multiple execution requests.
• Application Behavior: Unexpected environment variable values (e.g., modified PATH, GIT_EXTERNAL_DIFF, or other env keys) present in host=node execution contexts that were not part of the originally approved command.
• Process: Node processes spawned by OpenClaw with environment variables inconsistent with configured or expected workflow parameters, particularly involving git-related env keys like GIT_EXTERNAL_DIFF.
• Network: Unusual or repeated API calls to approval consumption endpoints from the same session/agent context with varying env payloads (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.2.26 or later, which enforces versioned systemRunBindingV1 approval matching and removes the legacy non-versioned fallback (Patch Commit). As interim measures, restrict access to approval IDs to trusted operators only, audit all approval-based workflows using system.run with host=node, and implement additional monitoring for approval ID reuse with differing environment inputs. Organizations not using exec approvals as an execution-integrity control in host=node workflows are not exposed to this vulnerability in practice (GitHub Advisory).

The vulnerability was reported by security researcher @tdjackey and acknowledged in the OpenClaw changelog and GitHub Security Advisory. The advisory was published by maintainer steipete and assigned moderate severity. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory).