CVE-2026-32971

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description An approval-integrity issue exists in node-host system.run approvals. The system displays extracted shell payloads instead of the actual executed argv, which can lead to a discrepancy between the command text shown to the operator and the command actually executed. For example, the UI might display a payload like jq --version while the system executes a different outer wrapper such as ./env sh -c 'jq --version'. An attacker capable of placing or selecting a local wrapper binary can induce wrapper-shaped commands to execute local code once an operator approves the misleading command text.

Recommendations Update to version 2026.3.11 or later.