Path Validation Bypass Vulnerability in OpenClaw on macOS

CVE-2026-32016

What is CVE-2026-32016?

OpenClaw versions prior to 2026.2.22 for macOS exhibit a critical pathway validation issue within the exec-approval allowlist mode. This flaw permits local attackers to bypass security measures by exploiting basename-only allowlist entries. Specifically, when the security is set to allowlist and ask is configured to on-miss, attackers can execute unauthorized binaries, such as local binaries with the same name (e.g., ./echo), without receiving proper approval. This undermines the intended restrictions placed on path-based policies, highlighting a serious security risk for systems relying on this product.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References