CVE-2026-32059: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32059 is an incorrect authorization vulnerability in OpenClaw (npm package) affecting versions up to and including 2026.2.22-2, fixed in version 2026.2.23. The flaw exists in the tools.exec.safeBins validation logic for the sort command, where GNU long-option abbreviations are not properly validated, allowing low-privileged attackers to bypass denied-flag checks and execute sort commands without required approval in allowlist mode. The vulnerability was published on March 11, 2026, with the advisory authored by VulnCheck and credited to reporter @tdjackey. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-184 (Incomplete List of Disallowed Inputs). The consumeLongOptionToken function in exec-safe-bin-policy.ts matched denied flags by exact string comparison only, meaning abbreviated GNU long options (e.g., --compress-prog instead of --compress-program) were not recognized as denied and were instead treated as unknown-but-acceptable options, bypassing the allowlist enforcement. This behavior is specific to configurations where tools.exec.security=allowlist, tools.exec.ask=on-miss, and sort is included in tools.exec.safeBins. The fix introduced a resolveCanonicalLongFlag function that expands abbreviations to their canonical form before checking against the denied-flags list, and rejects unknown or ambiguous abbreviations fail-closed (GitHub Advisory, Fix Commit).

Successful exploitation allows a remote, low-privileged attacker to execute sort commands with dangerous flags (such as --compress-program, which can invoke arbitrary external executables) without triggering the approval workflow required by the allowlist policy. This can result in high impact to confidentiality, integrity, and availability — including unauthorized data access, arbitrary command execution via external program invocation, and potential for further lateral movement within the affected environment (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.057%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, GitHub Advisory).

1. Identify target configuration: Confirm the target OpenClaw instance is running version ≤ 2026.2.22-2 with tools.exec.security=allowlist, tools.exec.ask=on-miss, and sort listed in tools.exec.safeBins.
2. Craft abbreviated long option: Construct a sort command invocation using an abbreviated form of a denied flag, such as --compress-prog (abbreviation of --compress-program) with an attacker-controlled value (e.g., --compress-prog=sh).
3. Submit command via API: As a low-privileged authenticated user, submit the crafted sort command through the OpenClaw tool execution interface. The validation logic will fail to match --compress-prog against the denied flag --compress-program and will not trigger the approval workflow.
4. Achieve arbitrary execution: The --compress-program flag causes sort to invoke the specified external program (e.g., sh) during operation, resulting in arbitrary command execution in the context of the OpenClaw process (GitHub Advisory, Fix Commit).

• Logs: OpenClaw execution logs showing sort commands invoked with abbreviated long options (e.g., --compress-prog, --files0-fro, --random-sou, --temporary-dir) that were not flagged for approval in allowlist mode.
• Process: Unexpected child processes spawned by the OpenClaw Node.js process, particularly shells (sh, bash) or other executables passed as values to --compress-program-style flags.
• File System: Unexpected output files or temporary directories created by sort invocations, particularly in locations not consistent with normal application behavior.
• Network: Outbound network connections initiated by child processes spawned from the OpenClaw service account, potentially indicating reverse shell or data exfiltration activity.

Upgrade OpenClaw (npm package) to version 2026.2.23 or later, which hardens safeBins long-option validation to resolve abbreviations to their canonical form and reject unknown or ambiguous flags fail-closed. If immediate patching is not possible, implement network-level access controls to restrict who can submit tool execution requests to the OpenClaw instance, and audit recent sort command executions in application logs for suspicious abbreviated flags. The fix is available at commit 3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f (GitHub Advisory, Fix Commit).

The vulnerability received coverage from The Hacker Wire and was noted across several vulnerability aggregation platforms including VulnCheck, INCIBE-CERT, and ENISA's EUVD. Social media activity was observed on Bluesky and Mastodon shortly after disclosure. Community reaction was limited in scope, consistent with the niche nature of the affected package (Feedly).