CVE-2026-32059: OpenClaw Auth Bypass Vulnerability

CVE-2026-32059 Overview

CVE-2026-32059 is an authorization bypass vulnerability affecting OpenClaw version 2026.2.22-2 prior to 2026.2.23. The tools.exec.safeBins validation for the sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode, potentially leading to unauthorized command execution.

Critical Impact

Attackers can bypass security controls in OpenClaw's safeBins execution policy by exploiting improper validation of GNU long-option abbreviations, enabling unauthorized command execution with dangerous flags that should be denied.

Affected Products

• OpenClaw version 2026.2.22-2 prior to 2026.2.23

Discovery Timeline

• 2026-03-11 - CVE-2026-32059 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32059

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), which occurs when an application does not properly verify that the requesting user has the appropriate privileges to perform a requested action. In the context of OpenClaw, the tools.exec.safeBins module implements a security policy to restrict which command-line flags can be passed to system binaries like sort. However, the validation logic fails to account for GNU-style long-option abbreviations.

GNU utilities typically allow users to abbreviate long options as long as the abbreviation is unambiguous. For example, --compress-program could be abbreviated to --compress-p or even --comp. The vulnerability arises because the safeBins policy checks for exact matches against denied flags (e.g., --compress-program), but attackers can bypass these checks by providing abbreviated versions that GNU sort still interprets correctly.

Root Cause

The root cause lies in the exec-safe-bin-policy.ts implementation, which performs string matching against a static list of denied flags without normalizing or expanding potential abbreviations. The validation assumes that users will pass full flag names, failing to account for GNU's flexible option parsing behavior.

Additionally, certain filesystem-dependent options like --random-source, --temporary-directory, and -T were originally placed in the allowed flags list rather than the denied flags list, despite breaking the stdin-only security guarantees that the safeBins policy is designed to enforce.

Attack Vector

The attack vector is network-based, requiring low privileges but no user interaction. An attacker with the ability to invoke sort commands through OpenClaw's execution framework can craft requests with abbreviated long options to bypass security controls.

For example, if --compress-program is denied but the attacker submits --compress-p=malicious_binary, the validation check fails to match against the denied list while GNU sort still executes the compressed program with the attacker-controlled binary.

       "--key",
       "--field-separator",
       "--buffer-size",
-      "--temporary-directory",
       "--parallel",
       "--batch-size",
-      "--random-source",
       "-k",
       "-t",
       "-S",
-      "-T",
     ],
     // --compress-program can invoke an external executable and breaks stdin-only guarantees.
-    deniedFlags: ["--compress-program", "--files0-from", "--output", "-o"],
+    // --random-source/--temporary-directory/-T are filesystem-dependent and not stdin-only.
+    deniedFlags: [
+      "--compress-program",
+      "--files0-from",
+      "--output",
+      "--random-source",
+      "--temporary-directory",
+      "-T",
+      "-o",
+    ],
   },
   uniq: {
     maxPositional: 0,

Source: GitHub Commit Update

Detection Methods for CVE-2026-32059

Indicators of Compromise

• Unusual sort command invocations with abbreviated long options (e.g., --compress-p, --random-s, --temp)
• Log entries showing sort commands with filesystem-dependent options like --temporary-directory or --random-source
• Unexpected external binary executions triggered through --compress-program variants
• Failed allowlist validation logs followed by successful command execution

Detection Strategies

• Implement logging for all safeBins command execution attempts, capturing the full argument list before and after validation
• Create detection rules that flag sort commands containing partial matches for known dangerous options
• Monitor for process creation events where sort spawns child processes (indicating potential --compress-program abuse)
• Audit OpenClaw execution logs for repeated attempts with variant flag spellings

Monitoring Recommendations

• Enable verbose logging for the tools.exec.safeBins module to capture all validation decisions
• Set up alerts for sort command executions that access filesystem paths outside expected directories
• Monitor for anomalous patterns in command-line argument lengths or structures
• Review SentinelOne telemetry for process chain anomalies involving the sort binary

How to Mitigate CVE-2026-32059

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.23 or later immediately
• Review execution logs for signs of exploitation using abbreviated option patterns
• Temporarily disable sort command execution through safeBins if upgrade is not immediately possible
• Audit any systems where OpenClaw may have been used with untrusted input

Patch Information

The security patch is available in OpenClaw version 2026.2.23. The fix moves filesystem-dependent options (--random-source, --temporary-directory, -T) from the allowed flags list to the denied flags list, and implements proper handling for GNU long-option abbreviation patterns.

For technical details, refer to the GitHub Security Advisory and the security patch commit.

Workarounds

• Implement input preprocessing to normalize all long options to their canonical full form before passing to safeBins validation
• Add prefix-matching logic to the denied flags check to catch abbreviated variants
• Restrict network access to OpenClaw instances until patching is complete
• Deploy application-level firewall rules to block requests containing suspicious sort flag patterns

# Upgrade OpenClaw to patched version
npm update openclaw@2026.2.23

# Verify the installed version
npm list openclaw

# Review recent execution logs for potential exploitation
grep -E "(--compress-p|--random-s|--temp)" /var/log/openclaw/exec.log