CVE-2026-32016: OpenClaw: macOS optional allowlist basename matching could bypass path-based policy
(updated )
On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example echo) as trusted command matches.
This could allow a same-name local binary (for example ./echo) to run without approval under security=allowlist + ask=on-miss.
References
- github.com/advisories/GHSA-7f4q-9rqh-x36p
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/dd41fadcaf58fd9deb963d6e163c56161e7b35dd
- github.com/openclaw/openclaw/security/advisories/GHSA-7f4q-9rqh-x36p
- nvd.nist.gov/vuln/detail/CVE-2026-32016
- www.vulncheck.com/advisories/openclaw-path-traversal-via-basename-only-allowlist-matching-on-macos
Code Behaviors & Features
Detect and mitigate CVE-2026-32016 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →