CVE-2026-32920: OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins
Published Mar 31, 2026
·Updated
OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.
Affected Software
2 affected components
OpenClaw OpenClaw<2026.3.12
OpenClaw Openclaw Node.js<2026.3.12
Event History
Mar 31, 2026
CVE Published
via MITRE·11:17 AM
Data Sourced
via MITRE·11:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-32920?
CVE-2026-32920 has a critical severity rating due to its potential for arbitrary code execution.
2
How do I fix CVE-2026-32920?
To fix CVE-2026-32920, upgrade OpenClaw to version 2026.3.12 or later.
3
What can attackers do with CVE-2026-32920?
Attackers can exploit CVE-2026-32920 to execute arbitrary code on affected systems.
4
What versions of OpenClaw are affected by CVE-2026-32920?
OpenClaw versions prior to 2026.3.12 are affected by CVE-2026-32920.
5
How does CVE-2026-32920 exploit the system?
CVE-2026-32920 exploits the system by automatically discovering and loading unverified plugins.