CVE-2026-32917 — OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the…¶

Key facts

CVE-2026-32917 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32917
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32917/

Details¶

CVE-2026-32917 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remote attachment staging is enabled.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32917
Type	RCE
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32917/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32917

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/a54bf71b4c0cbe554a84340b773df37ee8e959de
https://github.com/openclaw/openclaw/security/advisories/GHSA-g2f6-pwvx-r275
https://www.vulncheck.com/advisories/openclaw-remote-command-injection-via-unsanitized-imessage-attachment-paths-in-scp

Generated by PoC Generator on 2026-04-10T15:50:10.917325048

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32917, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32917 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw iMessage attachment RCE attempt - shell metacharacters"; flow:to_server,established; content:"iMessage"; content:"attachment"; content:"|3b|"; distance:0; within:100; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw iMessage attachment RCE attempt - pipe metacharacter"; flow:to_server,established; content:"iMessage"; content:"attachment"; content:"|7c|"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw iMessage attachment RCE attempt - ampersand metacharacter"; flow:to_server,established; content:"iMessage"; content:"attachment"; content:"&"; distance:0; within:100; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw iMessage attachment RCE attempt - backtick command substitution"; flow:to_server,established; content:"iMessage"; content:"attachment"; content:"`"; distance:0; within:100; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw iMessage attachment RCE attempt - dollar command substitution"; flow:to_server,established; content:"iMessage"; content:"attachment"; content:"$("; distance:0; within:100; classtype:attempted-admin; sid:1000004; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2026-32917 OpenClaw SCP command injection attempt"; flow:to_server,established; content:"scp"; content:"|3b|"; distance:0; within:50; classtype:attempted-admin; sid:1000005; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2026-32917 OpenClaw SCP command injection with pipe"; flow:to_server,established; content:"scp"; content:"|7c|"; distance:0; within:50; classtype:attempted-admin; sid:1000006; rev:1; priority:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32917 OpenClaw malicious attachment path traversal"; flow:to_server,established; content:"attachment"; content:"../"; distance:0; within:100; content:"|3b|"; distance:0; within:20; classtype:attempted-admin; sid:1000007; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32917_OpenClaw_RCE_iMessage_Attachment {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation attempts for CVE-2026-32917 - OpenClaw iMessage attachment staging RCE"
        cve = "CVE-2026-32917"
        date = "2024-12-19"
        severity = "critical"
        reference = "OpenClaw remote command injection in iMessage attachment staging flow"

    strings:
        $scp_injection1 = /scp.*[;&|`$()]\s*\w+/ nocase
        $scp_injection2 = /scp.*['"]\s*[;&|`$()]\s*/ nocase
        $attachment_path1 = /attachment.*[;&|`$()]\s*(rm|cat|wget|curl|nc|bash|sh)/ nocase
        $attachment_path2 = /staging.*[;&|`$()]\s*(rm|cat|wget|curl|nc|bash|sh)/ nocase
        $imessage_flow1 = "iMessage" ascii
        $imessage_flow2 = "attachment staging" ascii
        $shell_metachar1 = { 3B 20 72 6D } // "; rm"
        $shell_metachar2 = { 26 26 20 } // "&&"
        $shell_metachar3 = { 7C 7C 20 } // "||"
        $shell_metachar4 = { 60 } // backtick
        $shell_metachar5 = { 24 28 } // "$("
        $openclaw_binary = "openclaw" ascii nocase
        $remote_staging = "remote attachment staging" ascii nocase
        $scp_command = /scp\s+.*\s+[^@]+@[^:]+:/ nocase

    condition:
        any of ($imessage_flow*) and 
        (
            (any of ($scp_injection*) and any of ($shell_metachar*)) or
            (any of ($attachment_path*) and any of ($shell_metachar*)) or
            ($openclaw_binary and $remote_staging and any of ($shell_metachar*)) or
            ($scp_command and any of ($shell_metachar*))
        )
}

rule CVE_2026_32917_OpenClaw_Malicious_Attachment_Path {
    meta:
        author = "Security Engineer"
        description = "Detects malicious attachment paths used in CVE-2026-32917 exploitation"
        cve = "CVE-2026-32917"
        date = "2024-12-19"
        severity = "high"

    strings:
        $malicious_path1 = /\/.*[;&|`]\s*(wget|curl|nc|netcat)/ nocase
        $malicious_path2 = /\.\.\/.*[;&|`]\s*(bash|sh|zsh)/ nocase
        $malicious_path3 = /['"]\s*[;&|`]\s*rm\s+-rf/ nocase
        $malicious_path4 = /attachment.*\$\([^)]+\)/ nocase
        $malicious_path5 = /staging.*`[^`]+`/ nocase
        $config_pattern = /remote.*staging.*enabled/ nocase
        $vulnerable_version = /OpenClaw.*202[0-5]/ nocase

    condition:
        any of ($malicious_path*) or
        ($config_pattern and $vulnerable_version)
}

rule CVE_2026_32917_OpenClaw_Memory_Artifacts {
    meta:
        author = "Security Engineer"
        description = "Detects memory artifacts from CVE-2026-32917 exploitation attempts"
        cve = "CVE-2026-32917"
        date = "2024-12-19"
        severity = "medium"

    strings:
        $mem_pattern1 = "scp" ascii wide
        $mem_pattern2 = "iMessage" ascii wide
        $mem_pattern3 = "attachment" ascii wide
        $mem_pattern4 = { 73 63 70 20 00 00 } // "scp " with nulls
        $mem_pattern5 = { 26 26 20 2F } // "&& /"
        $mem_pattern6 = { 3B 20 65 63 68 6F } // "; echo"
        $process_name = "openclaw" ascii wide nocase

    condition:
        $process_name and 
        (
            (3 of ($mem_pattern1, $mem_pattern2, $mem_pattern3)) or
            any of ($mem_pattern4, $mem_pattern5, $mem_pattern6)
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-32917 OpenClaw RCE Prevention Rules
# Block remote command injection via iMessage attachment staging

# Block requests to OpenClaw attachment staging endpoints
location ~* /(?:api/|)(?:imessage|attachment|staging|scp)/ {
    # Block shell metacharacters in paths and parameters
    if ($request_uri ~* "[\;\|\&\$\`\(\)\{\}\[\]\<\>\'\"\\\*\?\~\!]") {
        return 403;
    }

    # Block common command injection patterns
    if ($request_uri ~* "(?:\||&&|;|`|\$\(|\${|<\(|>\()" ) {
        return 403;
    }

    # Block encoded shell metacharacters
    if ($request_uri ~* "(?:%3B|%7C|%26|%24|%60|%28|%29|%7B|%7D|%5B|%5D|%3C|%3E|%27|%22|%5C|%2A|%3F|%7E|%21)" ) {
        return 403;
    }

    # Block SCP and SSH related command injection attempts
    if ($request_uri ~* "(?:scp\s|ssh\s|rsync\s|\-o\s|\-i\s)" ) {
        return 403;
    }
}

# Additional protection for attachment upload/staging endpoints
location ~* /(?:upload|stage|attach|remote)/ {
    # Block directory traversal with shell injection
    if ($request_uri ~* "\.\..*[\;\|\&\$\`]") {
        return 403;
    }

    # Block command substitution patterns
    if ($request_uri ~* "\$\([^)]*\)|`[^`]*`|\${[^}]*}") {
        return 403;
    }
}

# Block malicious POST data for attachment staging
location ~* /(?:api/|)(?:imessage|attachment)/(?:stage|upload|process)/ {
    # Inspect request body for shell metacharacters
    if ($request_body ~* "[\;\|\&\$\`\(\)\{\}\[\]\<\>\'\"\\\*\?\~\!]") {
        return 403;
    }

    # Block encoded payloads in POST body
    if ($request_body ~* "(?:%3B|%7C|%26|%24|%60|%28|%29|%7B|%7D)" ) {
        return 403;
    }
}

# Block specific OpenClaw vulnerable parameters
location / {
    # Block remote_path parameter with shell metacharacters
    if ($args ~* "(?:remote_path|attachment_path|staging_path)=.*[\;\|\&\$\`\(\)]") {
        return 403;
    }

    # Block SCP syntax in parameters
    if ($args ~* "(?:remote_path|attachment_path)=.*:.*[\;\|\&]") {
        return 403;
    }
}

# Add security headers for all OpenClaw endpoints
location / {
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy strict-origin-when-cross-origin;
}

# Log blocked attempts for monitoring
error_log /var/log/nginx/openclaw_security.log;
access_log /var/log/nginx/openclaw_access.log combined;

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32917 - OpenClaw RCE via iMessage attachment staging
# Prevents command injection through unsanitized attachment paths

# Rule 1000000: Block shell metacharacters in attachment paths
SecRule ARGS "@detectSQLi" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-32917: Shell metacharacters detected in attachment path',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'CVE-2026-32917',\
    tag:'OWASP_CRS'"

# Rule 1000001: Block common shell metacharacters and command separators
SecRule ARGS "@rx [;&|`$(){}[\]\\<>\"'*?~]" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-32917: Shell metacharacters in attachment parameters',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'CVE-2026-32917'"

# Rule 1000002: Block command injection patterns in attachment staging requests
SecRule REQUEST_URI "@rx /attachment|/staging|/imessage" \
    "id:1000002,\
    phase:1,\
    pass,\
    msg:'CVE-2026-32917: OpenClaw attachment staging endpoint detected',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:INFO,\
    tag:'CVE-2026-32917',\
    chain"
    SecRule ARGS "@rx (\||;|&|`|\$\(|\$\{|\\x[0-9a-f]{2})" \
        "msg:'CVE-2026-32917: Command injection attempt in attachment staging',\
        logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
        severity:CRITICAL,\
        block"

# Rule 1000003: Block SCP command patterns and path traversal
SecRule ARGS "@rx (\.\.\/|\.\.\\|scp\s|ssh\s|rsync\s)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-32917: SCP/SSH command or path traversal detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-traversal',\
    tag:'CVE-2026-32917'"

# Rule 1000004: Block encoded shell metacharacters
SecRule ARGS "@rx (%3B|%26|%7C|%60|%24|%28|%29|%7B|%7D)" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-32917: URL-encoded shell metacharacters detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'CVE-2026-32917'"

# Rule 1000005: Monitor and block POST requests to attachment endpoints
SecRule REQUEST_METHOD "@streq POST" \
    "id:1000005,\
    phase:1,\
    pass,\
    msg:'CVE-2026-32917: POST request to potential OpenClaw endpoint',\
    severity:INFO,\
    tag:'CVE-2026-32917',\
    chain"
    SecRule REQUEST_URI "@rx /(attachment|staging|imessage)" \
        "chain"
        SecRule REQUEST_BODY "@rx [;&|`$(){}[\]\\<>]" \
            "block,\
            msg:'CVE-2026-32917: Shell metacharacters in POST body to attachment endpoint',\
            logdata:'Matched Data: %{MATCHED_VAR}',\
            severity:CRITICAL"

# Rule 1000006: Block common command injection payloads
SecRule ARGS "@rx (curl\s|wget\s|nc\s|netcat|bash|sh\s|/bin/|/usr/bin/|exec|eval)" \
    "id:1000006,\
    phase:2,\
    block,\
    msg:'CVE-2026-32917: Command execution keywords detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'CVE-2026-32917'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32917?¶

CVE-2026-32917 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32917?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32917?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.