CVE-2026-32065 is an approval-integrity bypass vulnerability affecting OpenClaw versions prior to 2026.2.25. This flaw in the system.run function allows an attacker to execute unintended commands by manipulating whitespace in command arguments, causing the displayed approval text to differ from the actual command executed. Rated as Medium severity (CVSS 6.5), the vulnerability has a network attack vector and low attack complexity, requiring low privileges but no user interaction, with its primary impact being high integrity compromise. Currently, there is no evidence of active exploitation, nor are public exploit modules available, and community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 2026.2.25CPE match | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | ||
< 2026.2.25CPE matchmatch criteria | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.