Most recent entries from all

BREW-openclaw-cli-CVE-2026-32973 — OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

Affected: Homebrew: openclaw-cli

### Summary

`matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the `?` wildcard could match `/`, which allowed matches to cross path segments.

### Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.

cnvd-2026-16894

EUVD-2026-329477

fkie_cve-2026-32973

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.

GHSA-3pvp-95ff-24g4

WID-SEC-W-2026-0711 — OpenClaw: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.