High severity8.8NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-32059

Description

OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.23	2026.2.23

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.23
- (no CPE)range: 2026.2.22-2
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.23

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6fnvdPatchWEB
github.com/advisories/GHSA-3c6h-g97w-fg78ghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-32059ghsaADVISORY
www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-sort-long-option-abbreviation-in-toolsexecsafebinsnvdBroken LinkWEB

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000