CVE-2026-32058: Openclaw Auth Bypass Vulnerability

CVE-2026-32058 Overview

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness (CWE-863: Incorrect Authorization) in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval ID can exploit this by reusing an approval with changed env input, effectively bypassing execution-integrity controls in approval-enabled workflows.

Critical Impact

This authorization bypass vulnerability enables attackers to circumvent approval workflow controls by reusing valid approval IDs with manipulated environment variables, potentially leading to unauthorized command execution in Node.js environments.

Affected Products

• OpenClaw versions prior to 2026.2.26
• OpenClaw for Node.js (all affected versions)

Discovery Timeline

• 2026-03-21 - CVE-2026-32058 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32058

Vulnerability Analysis

The vulnerability stems from insufficient context binding in OpenClaw's approval workflow system. When executing commands via system.run with host=node, the approval mechanism fails to properly bind the approval context to all relevant request parameters, specifically the environment variables. This architectural flaw allows an attacker who has obtained a valid approval ID to replay the approval request while substituting different environment variable values.

The attack requires network access and user interaction, along with low-privilege access to obtain an approval ID. While the complexity of exploitation is elevated due to the prerequisite conditions, the integrity impact allows attackers to modify execution contexts in ways not originally authorized.

Root Cause

The root cause is an incorrect authorization check (CWE-863) in the approval validation logic. When an approval is created for a system.run operation, the system does not cryptographically bind or verify the environment variables (env input) against the original approved request. This design oversight allows the approval token to be valid even when the execution context has been modified.

Attack Vector

The attack follows this sequence:

1. An attacker obtains access to a valid approval ID from an approval-enabled workflow
2. The attacker crafts a new request using the same approval ID but with modified environment variables
3. The OpenClaw system validates the approval ID without verifying the environment variable integrity
4. The modified command executes with the attacker-controlled environment variables, bypassing the intended approval controls

The vulnerability is exploited over the network and requires an authenticated user with low privileges to have access to approval IDs. User interaction is required as part of the workflow process, and the attack complexity is high due to the specific conditions required.

Detection Methods for CVE-2026-32058

Indicators of Compromise

• Unexpected reuse of approval IDs across multiple system.run requests with different parameters
• Audit log entries showing approval ID reuse with varying environment variable configurations
• Anomalous execution patterns in Node.js host workflows where approved commands have unexpected environment contexts

Detection Strategies

• Monitor approval workflow logs for approval ID reuse patterns, particularly where the same approval is associated with different env parameters
• Implement alerting for system.run executions where the environment variables differ from the originally approved request
• Audit authentication and authorization events in OpenClaw deployments for signs of approval context manipulation

Monitoring Recommendations

• Enable verbose logging for all approval-related operations in OpenClaw
• Create correlation rules to detect approval ID reuse across distinct request contexts
• Review system.run execution logs periodically for unauthorized environment variable modifications

How to Mitigate CVE-2026-32058

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.26 or later immediately
• Audit existing approval workflows for any signs of exploitation
• Review and rotate any approval IDs that may have been exposed to untrusted parties
• Temporarily disable system.run with host=node in approval workflows if immediate patching is not possible

Patch Information

OpenClaw has released a security patch in version 2026.2.26 that addresses this approval context-binding weakness. The fix is available in commit 10481097f8e6dd0346db9be0b5f27570e1bdfcfa. For full details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-hjvp-qhm6-wrh2.

Workarounds

• Restrict access to approval IDs by implementing additional access controls around approval workflow data
• Implement application-level logging to detect environment variable changes between approval creation and execution
• Use network segmentation to limit exposure of OpenClaw instances processing approval workflows
• Consider implementing custom validation hooks to verify environment variable integrity before execution