CVE-2026-32971: Openclaw RCE Vulnerability

CVE-2026-32971 Overview

CVE-2026-32971 is an approval-integrity vulnerability in OpenClaw's node-host system.run approvals that displays extracted shell payloads instead of the executed argv. This User Interface (UI) Misrepresentation of Critical Information (CWE-451) allows attackers to deceive operators by presenting misleading command text during the approval process. When operators approve what appears to be a benign command, the system actually executes attacker-controlled code through wrapper binaries.

Critical Impact

Attackers can achieve local code execution by placing wrapper binaries and inducing wrapper-shaped commands that execute malicious code after operators approve misleading command text, bypassing human security review.

Affected Products

• OpenClaw versions prior to 2026.3.11
• OpenClaw Node.js installations with node-host system.run approvals
• Systems using OpenClaw approval workflows for command execution

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-32971 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-32971

Vulnerability Analysis

This vulnerability exploits a fundamental disconnect between what operators see during command approval and what actually gets executed. The system.run approval mechanism in OpenClaw's node-host component extracts and displays shell payload text from incoming requests. However, the displayed text does not accurately represent the actual argv (argument vector) that will be executed by the underlying system.

The attack hinges on CWE-451: User Interface Misrepresentation of Critical Information. Operators reviewing command approval requests rely on the displayed command text to make security decisions. When the approval UI shows a sanitized or benign-looking command while the system prepares to execute a different, potentially malicious command, the entire human-in-the-loop security control becomes ineffective.

Root Cause

The root cause is a mismatch between the approval UI display logic and the actual command execution path. The approval system parses and displays extracted shell payloads, but the execution subsystem uses the original argv without the same interpretation. This allows specially crafted requests to present one command to the approver while executing another entirely different command through wrapper binaries placed in the execution path.

Attack Vector

The attack requires network access and user interaction (operator approval) to exploit. An attacker with low privileges can:

1. Place malicious wrapper binaries in locations where they will be resolved during command execution
2. Craft command requests that appear benign when the shell payload is extracted for display
3. Submit these "wrapper-shaped" commands through the normal approval workflow
4. Wait for an operator to approve the misleading command text
5. Achieve local code execution when the approval triggers execution of the actual malicious argv

The vulnerability mechanism exploits the trust operators place in the approval UI. By crafting commands where the displayed shell payload differs from the executed argv, attackers effectively bypass human security review. For detailed technical analysis, see the GitHub Security Advisory.

Detection Methods for CVE-2026-32971

Indicators of Compromise

• Unexpected wrapper binaries appearing in PATH directories or common binary locations
• Discrepancies between approved command logs and actual execution logs
• Unusual process spawning patterns following approval events
• New or modified executables in user-writable directories that could intercept common commands

Detection Strategies

• Implement logging that captures both the displayed approval text and the actual executed argv for comparison
• Monitor for file system changes in directories that could house wrapper binaries
• Audit process execution chains to detect wrapper binary interception
• Review approval logs for patterns consistent with wrapper-shaped command structures

Monitoring Recommendations

• Enable detailed audit logging for all system.run approval events including both display text and execution parameters
• Deploy file integrity monitoring on binary directories to detect wrapper binary placement
• Correlate approval timestamps with subsequent process executions to identify anomalies
• Alert on execution of commands from non-standard paths immediately following approval events

How to Mitigate CVE-2026-32971

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.11 or later immediately
• Review recent approval logs for suspicious wrapper-shaped commands
• Audit systems for unauthorized wrapper binaries in PATH directories
• Temporarily increase scrutiny of all system.run approval requests

Patch Information

OpenClaw has released version 2026.3.11 which addresses this approval-integrity vulnerability. The patch ensures that the approval UI accurately displays the actual command that will be executed, eliminating the mismatch between displayed text and executed argv. Organizations should update to this version as soon as possible.

For complete patch details, see the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Restrict write access to directories in the execution PATH to prevent wrapper binary placement
• Implement additional out-of-band verification for sensitive command approvals
• Deploy application allowlisting to prevent execution of unauthorized binaries
• Consider temporarily disabling automated approval workflows until patching is complete

# Configuration example - Restrict PATH directories and enhance logging
# Audit current PATH for user-writable directories
for dir in $(echo $PATH | tr ':' ' '); do
  ls -la "$dir" 2>/dev/null | head -5
done

# Enable enhanced OpenClaw logging (consult documentation for exact syntax)
# openclaw config set logging.approval.verbose true
# openclaw config set logging.execution.capture_argv true