CVE-2026-32973 — OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where…

Key facts

CVE-2026-32973 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-32973
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32973/

Details

CVE-2026-32973 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by operators.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-32973
CVSS Score	9.8

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32973/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2026-32973

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-f8r2-vg7x-gh8m
• https://www.vulncheck.com/advisories/openclaw-exec-allowlist-pattern-overmatch-via-posix-path-normalization

---

Generated by PoC Generator on 2026-04-10T15:57:30.786694113

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-32973, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-32973 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32973 OpenClaw exec allowlist bypass attempt"; flow:established,to_server; content:"openclaw"; nocase; content:"exec"; nocase; distance:0; within:100; pcre:"/[a-zA-Z0-9\/]*\?[a-zA-Z0-9\/]*/i"; sid:1000000; rev:1; classtype:attempted-admin; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32973 OpenClaw wildcard path traversal in exec"; flow:established,to_server; content:"exec"; nocase; pcre:"/exec.*[\?]{1}.*[\/\\]/i"; sid:1000001; rev:1; classtype:attempted-admin; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32973 OpenClaw glob pattern bypass attempt"; flow:established,to_server; content:"matchesExecAllowlistPattern"; nocase; content:"?"; distance:0; within:50; sid:1000002; rev:1; classtype:attempted-admin; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32973 OpenClaw POSIX path manipulation with wildcards"; flow:established,to_server; pcre:"/\/[^\/]*\?[^\/]*\/.*exec/i"; sid:1000003; rev:1; classtype:attempted-admin; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32973 OpenClaw allowlist bypass via case manipulation"; flow:established,to_server; content:"exec"; nocase; content:"allowlist"; nocase; distance:0; within:100; pcre:"/[A-Z]{1}.*[a-z]{1}.*\?/"; sid:1000004; rev:1; classtype:attempted-admin; priority:2;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32973_OpenClaw_Exec_Allowlist_Bypass {
    meta:
        cve = "CVE-2026-32973"
        author = "Security Engineer"
        description = "Detects OpenClaw exec allowlist bypass exploitation attempts using wildcard path traversal"
        severity = "high"
        date = "2024"

    strings:
        $openclaw_binary = "openclaw" nocase
        $exec_pattern1 = /matchesExecAllowlistPattern/
        $exec_pattern2 = /ExecAllowlistPattern/

        // Wildcard bypass patterns
        $wildcard_bypass1 = /[\w\/]*\?[\w\/]*\?[\w\/]*/
        $wildcard_bypass2 = /\/[^\/]*\?[^\/]*\//
        $wildcard_bypass3 = /../?../

        // Path traversal with wildcards
        $path_traversal1 = /\.\.[\/\\]\?/
        $path_traversal2 = /\?[\/\\]\.\./
        $path_traversal3 = /[\/\\]\?\?\?[\/\\]/

        // Command execution patterns
        $cmd_exec1 = /exec\([^)]*\?[^)]*\)/
        $cmd_exec2 = /system\([^)]*\?[^)]*\)/
        $cmd_exec3 = /\/bin\/[^\/]*\?[^\/]*/
        $cmd_exec4 = /\/usr\/bin\/[^\/]*\?[^\/]*/

        // Glob pattern abuse
        $glob_abuse1 = /\*\?\*/ 
        $glob_abuse2 = /\?\?\?/
        $glob_abuse3 = /\?[a-z]\?/

        // Hex patterns for binary exploitation
        $hex_pattern1 = { 6D 61 74 63 68 65 73 45 78 65 63 41 6C 6C 6F 77 6C 69 73 74 50 61 74 74 65 72 6E }
        $hex_pattern2 = { 2F 3F 2F }
        $hex_pattern3 = { 3F 3F 3F }

    condition:
        (
            $openclaw_binary or 
            any of ($exec_pattern*)
        ) and (
            any of ($wildcard_bypass*) or
            any of ($path_traversal*) or
            any of ($cmd_exec*) or
            any of ($glob_abuse*) or
            any of ($hex_pattern*)
        )
}

rule CVE_2026_32973_OpenClaw_Malicious_Config {
    meta:
        cve = "CVE-2026-32973"
        author = "Security Engineer"
        description = "Detects malicious OpenClaw configuration files with allowlist bypass patterns"
        severity = "medium"
        date = "2024"

    strings:
        $config_header = "# OpenClaw" nocase
        $allowlist_config = "exec_allowlist" nocase
        $allowlist_config2 = "execAllowlist" nocase

        // Suspicious wildcard configurations
        $suspicious_config1 = /allowlist.*=.*\?.*\?/
        $suspicious_config2 = /pattern.*=.*\/\?/
        $suspicious_config3 = /exec.*=.*\.\.\//

        // Common bypass patterns in configs
        $bypass_config1 = "*/bin/?*"
        $bypass_config2 = "*/usr/?*"  
        $bypass_config3 = "*/?/../*"
        $bypass_config4 = "*/???/*"

    condition:
        (
            $config_header or
            any of ($allowlist_config*)
        ) and (
            any of ($suspicious_config*) or
            any of ($bypass_config*)
        )
}

rule CVE_2026_32973_OpenClaw_Memory_Artifacts {
    meta:
        cve = "CVE-2026-32973"
        author = "Security Engineer"
        description = "Detects memory artifacts from OpenClaw allowlist bypass exploitation"
        severity = "high"
        date = "2024"

    strings:
        $func_name = "matchesExecAllowlistPattern"
        $normalize_func = "normalizePattern" nocase
        $glob_func = "globMatch" nocase
        $lowercase_func = "toLowerCase" nocase

        // Memory patterns indicating exploitation
        $mem_pattern1 = { 2F ?? 2F ?? 2F }
        $mem_pattern2 = { 3F 2F 3F 2F }
        $mem_pattern3 = { 2E 2E 2F 3F }

        // Stack traces or error messages
        $error_msg1 = "allowlist pattern bypass"
        $error_msg2 = "glob pattern overflow"
        $error_msg3 = "path normalization error"

    condition:
        (
            $func_name and (
                $normalize_func or $glob_func or $lowercase_func
            )
        ) or (
            any of ($mem_pattern*) and filesize < 10MB
        ) or (
            any of ($error_msg*)
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-32973 - OpenClaw exec allowlist bypass prevention
# Block requests targeting OpenClaw endpoints with malicious patterns

location ~* /openclaw {
    # Block requests with suspicious wildcard patterns in query parameters
    if ($query_string ~* "[?*]+.*[/\\]") {
        return 403;
    }

    # Block requests with path traversal attempts using wildcards
    if ($uri ~* "\?[^&]*[/\\]") {
        return 403;
    }

    # Block requests with multiple consecutive wildcards
    if ($args ~* "\?{2,}") {
        return 403;
    }

    # Block requests attempting to bypass allowlist with case variations
    if ($args ~* "(?i)(exec|command|cmd|shell|bash|sh)\?") {
        return 403;
    }

    # Block suspicious POSIX path patterns with wildcards
    if ($request_uri ~* "\?[^?/]*(/|%2f|%2F)") {
        return 403;
    }

    # Block encoded wildcard characters
    if ($args ~* "(%3f|%2a|\?|%c0%af|%252f)") {
        return 403;
    }

    # Add security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";

    proxy_pass http://backend;
}

# Additional protection for any OpenClaw API endpoints
location ~* /api/openclaw {
    # Block POST/PUT requests with wildcard patterns in body
    if ($request_method ~* "^(POST|PUT)$") {
        set $block_request 0;
        if ($request_body ~* "\?.*[/\\]") {
            set $block_request 1;
        }
        if ($block_request) {
            return 403;
        }
    }

    # Block requests with suspicious file extensions after wildcards
    if ($uri ~* "\?.*\.(sh|bash|exe|bin|com|bat)") {
        return 403;
    }

    proxy_pass http://backend;
}

# Block direct access to OpenClaw configuration or sensitive files
location ~* /openclaw.*\.(conf|config|cfg|ini|properties)$ {
    deny all;
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32973 - OpenClaw exec allowlist bypass
# Protects against glob pattern bypass and POSIX path manipulation

# Rule 1000000: Block requests with suspicious glob patterns in exec parameters
SecRule ARGS "@detectSQLi" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Potential OpenClaw glob pattern bypass attempt',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000001: Detect wildcard characters in exec-related parameters
SecRule ARGS "@rx (?i).*[\?\*\[\]].*(?:exec|command|cmd|run|shell)" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Wildcard characters detected in exec parameters',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000002: Block POSIX path traversal with question mark wildcards
SecRule ARGS "@rx (?i).*[\/\\].*\?.*[\/\\]" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: POSIX path traversal with wildcard detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'attack-traversal',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000003: Detect glob pattern bypass attempts in request body
SecRule REQUEST_BODY "@rx (?i).*\?[^\/\s]*[\/\\].*(?:exec|command|run|shell)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Glob pattern bypass in request body',\
    logdata:'Matched Data: %{MATCHED_VAR}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000004: Block requests with multiple wildcards in path segments
SecRule ARGS "@rx (?i).*[\/\\][^\/\\]*[\?\*][^\/\\]*[\/\\][^\/\\]*[\?\*]" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Multiple wildcards in path segments detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000005: Detect case manipulation attempts with exec patterns
SecRule ARGS "@rx (?i).*[A-Z].*[a-z].*\?.*(?:exec|command|cmd)" \
    "id:1000005,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Case manipulation with exec pattern detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:MEDIUM,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000006: Block URI paths with suspicious glob patterns
SecRule REQUEST_URI "@rx (?i).*\?.*[\/\\].*(?:exec|command|run|shell|bin)" \
    "id:1000006,\
    phase:1,\
    block,\
    msg:'CVE-2026-32973: Suspicious glob pattern in URI path',\
    logdata:'Matched Data: %{MATCHED_VAR}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000007: Detect encoded wildcard bypass attempts
SecRule ARGS "@rx (?i).*%3[fF].*%2[1-9A-Fa-f].*(?:exec|command)" \
    "id:1000007,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: URL encoded wildcard bypass attempt',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

# Rule 1000008: Block requests with OpenClaw-specific vulnerable patterns
SecRule ARGS "@rx (?i).*matchesExecAllowlistPattern.*\?" \
    "id:1000008,\
    phase:2,\
    block,\
    msg:'CVE-2026-32973: Direct OpenClaw allowlist pattern manipulation',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'attack-injection',\
    tag:'cve-2026-32973',\
    tag:'openclaw'"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-32973?

CVE-2026-32973 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32973?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32973?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

---

For authorized security testing and research only. See the full source and NVD record.