CVE-2026-32973
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Mar 29, 2026
CISA due date
—
The record
OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79965 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-625
- CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
- CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
- CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-625
- CVE-2026-82726 Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote… CWE-625
- CVE-2026-55536 PraisonAI is a multi-agent teams system. CWE-625
- CVE-2026-19278 A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. CWE-625
- CVE-2026-64940 Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability… CWE-625