Is CVE-2026-32056 actively exploited?

No active exploitation of CVE-2026-32056 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32056 be exploited remotely?

Yes. CVE-2026-32056 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32056?

CVE-2026-32056 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-32056

CRITICAL

CVE-2026-32056

CWE-78Published: March 21, 2026· Updated: Mar 23, 2026

9.8

CVSS v3.1

EPSS:0.15%probability of exploitation in 30 daysPercentile:35.8th

Official Description

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.

NVD Source

Risk Analysis

This critical vulnerability in OpenClaw versions prior to 2026.2.22 allows remote attackers to bypass command allowlist protections and achieve arbitrary code execution. With a CVSS score of 9.8, this flaw poses a significant risk for full system compromise. There is no EPSS score to indicate exploitation likelihood, and it is not in CISA's KEV catalog.

No public exploit is known for this vulnerability, but it is remotely exploitable without authentication. Attackers can inject malicious startup files by manipulating environment variables, leading to arbitrary code execution.

Recommended Action

Upgrade OpenClaw to version 2026.2.22 or later to address the environment variable sanitization issue. Implement strict input validation and sanitize all environment variables used in command execution.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-32056 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.