CVE-2026-32059

High

Description

OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.

SeverityHigh

CVSS8.8

Exploit probability—

ProductOpenclaw

PublishedMar 11, 2026

First seenMar 11, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

openclaw openclaw2026.2.23 or later

Patches

github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f

Vendor advisories

github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78

Affected products

Product	Affected versions	Fixed in
openclaw openclaw	v < 2026.2.23	2026.2.23

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.