CVE-2026-29608 MEDIUM

CVE-2026-29608: OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting

Vendor Openclaw
Product OpenClaw
Weakness CWE-88
Published March 19, 2026
Last update March 19, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 19, 2026 Record updated