p PatchFirst

CVE-2026-32009

CVE-2026-32009 · OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An attacker with write access to these trusted directories can place a malicious binary with the same name as an allowed executable to achieve arbitrary command execution within the OpenClaw runtime context.

CVSS 7.0 · Alta · EPSS 0,1% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 2026.2.24: Afectada (semver)
    • 2026.2.24: No afectada (semver)

    Actualiza a 2026.2.24

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.2.24

    Actualiza a 2026.2.24

Fuentes originales

Comprueba tu servidor →