CVE-2026-32015

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32015
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32015.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32015
Aliases
Published
2026-03-19T22:06:52.761Z
Modified
2026-07-08T08:12:46.741525253Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation
Details

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling process PATH resolution. Attackers who can influence the gateway process PATH or launch environment can execute trojan binaries with allowlisted names, such as jq, circumventing executable validation controls.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-426"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32015.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
80c1edc3ff43b3bd3b7b545eed79f303d992f7dc
Fixed
2c05cbb43e48ebad03626d3125746fb1b9a8520f
Fixed
28bac46c92069dc728524fbf383024c1b64e5c23
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2026.1.21"
        },
        {
            "fixed": "2026.2.19"
        }
    ],
    "cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2026.*
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.2
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32015.json"