CVE-2026-32978: OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32978?
CVE-2026-32978 is classified as an approval integrity vulnerability in OpenClaw versions prior to 2026.3.11.
How do I fix CVE-2026-32978?
To mitigate CVE-2026-32978, update OpenClaw to version 2026.3.11 or later.
What type of vulnerability is CVE-2026-32978?
CVE-2026-32978 is an approval bypass vulnerability that affects the integrity of script runner approvals.
Which versions of OpenClaw are affected by CVE-2026-32978?
OpenClaw versions earlier than 2026.3.11 are affected by CVE-2026-32978.
What can attackers gain from exploiting CVE-2026-32978?
Attackers can exploit CVE-2026-32978 to obtain approval for benign scripts through unrecognized script runners.