CVE-2026-32973

CVE-2026-32973 is a critical exec allowlist bypass vulnerability affecting OpenClaw versions prior to 2026.3.11. This flaw allows attackers to exploit improper pattern normalization and glob matching, specifically the '?' wildcard across path segments, to execute unintended commands or paths. Rated 9.8 Critical, it has a network attack vector, low attack complexity, and requires no privileges or user interaction, enabling full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV) or public exploit code available, the vulnerability has garnered some community discussion across platforms like Bluesky and Mastodon.