CVE-2026-32921: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32921 is an approval bypass vulnerability in OpenClaw's system.run function caused by a Time-of-Check Time-of-Use (TOCTOU) race condition. Mutable script operands are not bound across the approval and execution phases, allowing a low-privileged attacker to obtain approval for a script execution, modify the approved script file before it runs, and execute different content while maintaining the same approved command shape. It affects all OpenClaw (npm) versions prior to 2026.3.8. The vulnerability was disclosed on March 31, 2026, with a CVSS v4.0 score of 5.3 (Medium) and a CVSS v3.1 score of 5.0 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition) combined with CWE-285 (Improper Authorization). When system.run processes an execution request, it approves the command based on the argv values (e.g., sh ./script.sh) but does not snapshot or bind the content of the mutable script file operand at approval time. This creates a window between approval and execution during which an attacker can overwrite the script file with arbitrary content. The initial fix (commit c76d292) addressed shell scripts and a narrow interpreter set, but a follow-up review found that bun and deno run script operands still lacked mutableFileOperand snapshots; a complete fix was shipped in commit cf3a479, which binds approved bun and deno run script operands to on-disk SHA-256 file snapshots and denies execution if post-approval drift is detected (GitHub Advisory, Commit c76d292, Commit cf3a479).

Successful exploitation allows a low-privileged attacker to execute unauthorized commands that bypass the approval control mechanism, resulting in low-level impacts across confidentiality, integrity, and availability. An attacker could access data they are not authorized to read, modify system state, or disrupt service availability. The scope is limited to the vulnerable system itself (no scope change), and lateral movement potential depends on the privileges of the OpenClaw process and the content of the injected script (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.048%, indicating a low probability of exploitation in the near term. Exploitation requires low-privileged network access and the ability to write to the approved script file between the approval and execution phases, which adds practical complexity.

1. Obtain low-privileged access: Acquire a low-privileged account or API token with permission to invoke system.run on the target OpenClaw instance (version ≤ 2026.3.7).
2. Prepare a benign script: Create a script file (e.g., ./script.sh, ./run.ts) with innocuous content that is likely to receive approval from the system or an operator.
3. Submit for approval: Invoke system.run with the benign script as an operand (e.g., sh ./script.sh or bun ./run.ts), triggering the approval workflow. The approved argv values are recorded, but the script file content is not snapshotted.
4. Race the execution window: Immediately after approval is granted but before execution begins, overwrite the approved script file with malicious content (e.g., a reverse shell, data exfiltration command, or destructive payload).
5. Trigger execution: Allow or trigger the execution phase. OpenClaw executes the now-modified script file under the previously approved command shape, running the attacker's injected content. (GitHub Advisory, Commit c76d292)

• File System: Unexpected modifications to script files (.sh, .ts, .js) in working directories used by OpenClaw between approval and execution timestamps; file modification times on approved scripts that postdate the approval event.
• Logs: OpenClaw execution logs showing a script being run whose content differs from what was reviewed/approved; audit log entries where the same command shape is approved and then executed in rapid succession with a file write event in between.
• Process: Unexpected child processes spawned by the OpenClaw node-host process (e.g., reverse shells, network utilities like curl, wget, nc) that are inconsistent with normal workflow activity.
• Network: Outbound connections from the OpenClaw host to unexpected external IP addresses or domains shortly after a system.run execution event.

Upgrade OpenClaw (npm package) to version 2026.3.8 or later, which contains the complete fix binding all interpreter-style script operands (shell, bun, deno run) to on-disk SHA-256 snapshots at approval time and denying execution if the file content drifts post-approval (GitHub Advisory, Commit cf3a479). For systems unable to patch immediately, restrict low-privileged user write access to directories containing approved scripts, and implement file integrity monitoring on those scripts to detect unauthorized modifications between approval and execution. Monitoring for rapid file modifications following system.run approval events can also serve as a compensating control.

The vulnerability was reported by researcher @tdjackey and credited in the official advisory and changelog. The advisory was initially published as GHSA-wwrj-437c-ppq4 but was subsequently withdrawn on April 6, 2026, as a duplicate of the canonical advisory GHSA-8g75-q649-6pv6 (Github Advisory, GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.