CVE-2026-32044
OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation
- State
- Published
- Severity
- 6.7 Medium
- Published
- Mar 21, 2026
- Updated
- Jun 23, 2026
- Reserved
- Mar 10, 2026
Description
OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attackers can craft malicious tar.bz2 skill archives to bypass special-entry blocking and extracted-size guardrails, causing local denial of service during skill installation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.7 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-77hf-7fqf-f227)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.