CVE-2026-32052 is a command injection in the OpenClaw system.run shell wrapper, scored 6.4 by NVD. Extra positional arguments after an inline shell payload could run while the approval text showed something else. Upgrade OpenClaw to 2026.2.24 or later. Checks and steps follow below.
What's affected
OpenClaw 2026.2.23 and earlier. The patched version is 2026.2.24.
It concerns approval of commands in system.run, where a person or policy approves what the screen shows before the command runs. The user sees one command and the system runs another.
How to check if you're exposed
OpenClaw is distributed on npm, so read the installed version.
npm ls openclaw
npm ls -g openclaw
OpenClaw release numbers are date based, so compare the version against the fixed release named above. If you run it in a container, check the image you deploy and rebuild it after updating.
What to do now
- Upgrade OpenClaw to 2026.2.24 or later.
- Until you do, treat approvals of shell wrapper commands as unreliable, and avoid approving commands you cannot read in full.
- Review your allowlist and approval policy for shell wrappers.
- Check history for system.run calls that you do not recognize.
Why it matters
The record lists CWE-436, interpretation conflict, and CWE-77, command injection. The display text and the executed argument list were built from different views of the same command. When they disagree, an approval is only as good as the text it was shown.
The fix binds the approval text to the full formatted argument list and rejects mismatches. It also validates consistency in the macOS companion app.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
What is the core lesson?
An approval step must show exactly what will run. If the display and execution differ, the check is worthless.
Sources
Last reviewed: 19 October 2026.
