https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:57:42.356746+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-32973 CVE-2026-32973 — OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization 2026-10-03T15:57:42.386922+00:00

Affected: OpenClaw

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.

 https://cve.radiocsirt.org/vuln/ghsa-f8r2-vg7x-gh8m GHSA-f8r2-vg7x-gh8m — OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths 2026-10-03T15:57:42.386993+00:00

Affected: npm: openclaw

### Summary

`matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the `?` wildcard could match `/`, which allowed matches to cross path segments.

### Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.