EUVD-2026-87490
GHSA-xp58-99vr-2354
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSteer agent via injected instruction
-
DeliveryIdentify a prior Allow-Always binary
-
ExploitRe-invoke same executable with malicious args
-
ExecutionApproval reused, no reprompt
-
ImpactAccess files or internal services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an operator previously granted an 'Allow Always' approval for at least one exact command, which OpenClaw then stores as a path-only grant on macOS or Linux. The attacker must then cause that same executable to be invoked with different arguments - in practice by steering the agent (e.g. via prompt/content injection), reflected in the CVSS UI:P and AT:P/AC:H metrics. Limiting factors: the vulnerability does not apply without a pre-existing Allow-Always approval; impact is bounded by the privileges of the OpenClaw process and the capabilities of the already-approved binary; and it affects only macOS and Linux approval storage, not a default remote-unauthenticated entry point. |
| Impact | This is a genuine but conditionally-gated authorization flaw (CWE-863) in OpenClaw's command-approval system, not an internet-facing pre-auth bug. The vendor CVSS 4.0 vector (7.7, AV:N/AC:H/AT:P/PR:N/UI:P) itself signals meaningful friction: high attack complexity (AC:H), an attack requirement (AT:P), and passive user interaction (UI:P). The core issue is that an 'Allow Always' approval for an exact command is stored as a path-only grant on macOS/Linux, so any later invocation of that same binary with different arguments silently reuses the grant. Realistically PR is not truly N - exploitation depends on a prior human 'Allow Always' decision existing plus the agent being steered (e.g. via prompt injection) into abusing it, which is closer to PR:L. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is no public exploit identified at time of analysis - a real defense-in-depth gap for OpenClaw operators but not an actively-exploited, widescale priority. The signals are internally consistent (AC:H/AT:P align with the 'must already have an approval + steer the agent' precondition); the main tension is the vendor's PR:N versus the description's implicit dependence on a pre-existing operator approval. |
| Exploit ScenarioDerived | An operator uses OpenClaw and clicks 'Allow Always' for a legitimate command such as a specific git or python invocation. Later, an attacker who can influence the agent's instructions (e.g. via injected content in a processed document or channel message) invokes that same executable with malicious arguments - reading sensitive files or reaching internal services - and no new approval prompt appears because the grant was stored path-only. No public exploit code is referenced; the attack is high-complexity and hinges on a pre-existing approval. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
RemediationAI
Upgrade to OpenClaw 2026.8.1 or later - this is the version boundary named in the vendor advisory (GHSA-74gc-hg2m-79p9, https://github.com/openclaw/openclaw/security/advisories/GHSA-74gc-hg2m-79p9), which is the authoritative fix; the VulnCheck write-up (https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-reusable-exec-approvals-authorization-bypass) provides corroborating detail. If upgrading cannot be done immediately, remove or reset previously persisted Allow Always grants so that no stale path-only approvals remain, and stop issuing new Allow Always decisions for general-purpose or interpreter binaries such as shells, scripting runtimes, package managers, or network clients - those are the binaries whose argument flexibility gives an attacker the most leverage; the trade-off is more frequent approval prompts for legitimate work. Tighten the privileges of the OpenClaw process and its host account so that a bypassed approval reaches only a low-privilege context, restrict the agent's reachable internal services and file paths, and monitor agent transcripts and process trees for the same executable being invoked repeatedly with unexpected arguments from attacker-influenced input. These compensating controls reduce but do not eliminate the exposure that the path-only grant design creates, so patching to 2026.8.1 remains the primary remedy. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, so prioritization should be based on whether Allow Always approvals are in active use on macOS or Linux hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-863 (Incorrect Authorization) in OpenClaw's command-approval subsystem, an agentic execution broker that asks the operator to approve tool and shell invocations. When an operator selects 'Allow Always' for an exact command, the approval should be bound to that full command line, but the implementation reduces the decision to the executable's path when persisting it on macOS and Linux. The result is a durable, over-broad grant: the authorization check compares only the binary path, so argument variation is invisible to the gate. Because the OpenClaw agent typically runs commands through a shell or exec broker, an attacker who can influence the agent's plan - for example by injecting instructions through fetched content, documents, or tool output - can select the arguments for the already-trusted binary, turning a narrow approval into arbitrary use of that binary's capabilities. Scope is bounded by the privileges of the OpenClaw process and the capabilities of the approved executable; the CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* is unbounded by version, so all releases prior to the fix are in scope. The vendor's CVSS 4.0 vector (7.7, AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, no subsequent-system impact) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) agree that confidentiality, integrity, and availability impact is high but confined to the OpenClaw host.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
PR:L and UI:R because a prior operator Allow-Always grant and a steered agent action are required; AC:H reflects the pre-existing-approval precondition; high C/I/A from arbitrary command reuse at process privileges.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.
Articles & Coverage 1
Technical POC Analysis
Evidence base: the GitHub advisory text only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw's command-approval design can be abused so that a binary an operator once approved with 'Allow Always' on macOS or Linux will later execute with attacker-chosen arguments and no fresh confirmation, effectively extending a single historical approval into a standing arbitrary-execution right on that host. Exposure is concentrated on developer and operations endpoints where OpenClaw runs under the user's own privileges, and it requires both a prior approval by that user and the attacker's ability to steer agent input, so this is a targeted-persistence and insider-adjacent risk rather than an internet-facing one. Leadership should care because the affected control is the product's primary safety gate: until remediated, every lingering approval grant represents an unmonitored execution path across the fleet.
No vendor-released patch identified at time of analysis; interim mitigations are to revoke and stop persisting 'Allow Always' path-only grants, mandate per-invocation approval showing full arguments, run OpenClaw under least-privilege accounts with a restricted approvable-binary allowlist, treat all agent input as untrusted to blunt prompt/content injection, and alert on agent-initiated execution of previously approved binaries with new arguments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB