EUVD-2026-101661
GHSA-pf9r-7pwp-j78c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to scan target
-
ExploitCraft path/content to defeat shouldSkipTargetPath
-
ImpactRisky skill/plugin evades static scanner detection
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires local access to the environment where ClawScan is run and the ability to supply attacker-controlled scan targets (a skill or OpenClaw plugin), then crafting a path that the shouldSkipTargetPath routine in internal/runner/runner.go wrongly classifies as skippable so the static scanner never inspects it. Per the fix, opaque executable content such as packaged Python bytecode is the class of content that previously slipped through. Limiting factors: the CVSS vector is local (AV:L) and requires privilege (PR:L), so a remote unauthenticated attacker cannot trigger it; the victim must actually run ClawScan against the attacker-supplied content, and only ClawScan Static (clawscan-static) deployments ≤0.1.6 are affected. |
| Impact | All signals point to a genuinely low-priority issue. The vendor CVSS 4.0 score is 1.9 (Low) with a vector of AV:L/AC:L/PR:L/UI:N and only Low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L), meaning exploitation is local, requires some privilege, and yields limited impact. The exploit maturity is marked E:P (Proof-of-Concept), consistent with the public exploit repository (nedlir/skills-scanner-bypass), so publicly available exploit code exists - but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The nature of the flaw (a static-scanner skip-logic bypass, CWE-693 protection mechanism failure) means it does not directly compromise a system; it allows crafted/opaque content to evade detection by ClawScan, which is a defense-weakening rather than a direct-compromise bug. Net: a real, patched, publicly-exploitable weakness but a low real-world priority - the low CVSS, local attack vector, required privilege, and absence of KEV all agree. The only mild tension is the 'Information Disclosure' tag, which does not match a scanner-bypass/protection-failure flaw. |
| Exploit ScenarioDerived | A local actor crafts a malicious OpenClaw skill or plugin (for example packaged Python bytecode) with a path or structure that the shouldSkipTargetPath function in ClawScan's static scanner incorrectly treats as skippable. When ClawScan runs, the risky content is silently skipped and never flagged, letting the attacker slip past the security gate. Public exploit code demonstrating this bypass is available (GitHub: nedlir/skills-scanner-bypass). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local users with low privileges can bypass the ClawScan Static scanner (clawscan-static) in OpenClaw ClawScan up to and including version 0.1.6 by supplying scan targets whose paths the tool wrongly treats as skippable, allowing content such as packaged Python bytecode to go uninspected while still being processed. The flaw is a path-classification error in shouldSkipTargetPath (internal/runner/runner.go), so the protection mechanism fails rather than being memory-corrupted, and impact is limited to low confidentiality, integrity, and availability effects (CVSS 4.0 base score 1.9; independently assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (a proof-of-concept scanner-bypass project) and exploitation requires the victim to actually run ClawScan against attacker-supplied content; there is no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 0.1.7.
RemediationAI
Upgrade OpenClaw ClawScan to version 0.1.7, which is the vendor-released fix (release tag https://github.com/openclaw/clawscan/releases/tag/v0.1.7; patch commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa; PR https://github.com/openclaw/clawscan/pull/41) - after upgrading, packaged Python bytecode is treated as opaque executable content rather than being silently skipped, which restores the scanner's coverage. If immediate upgrade is not possible, compensate by treating scan results from any ClawScan build at or below 0.1.6 as untrusted: do not rely on clawscan-static as a sole gate, and manually inspect any skill or OpenClaw plugin that contains compiled artifacts (for example .pyc files or bundled bytecode), since those are exactly the inputs the flawed shouldSkipTargetPath logic let through; the trade-off is higher manual review cost and slower onboarding of third-party skills. Also restrict who can place scan targets into the paths ClawScan processes, given the flaw requires local access and the ability to supply attacker-controlled content (PR:L), and note that this restriction is only a partial control because any legitimate local contributor could be the source. Vendor advisory references are https://vuldb.com/vuln/419836 and https://github.com/openclaw/clawscan/issues/39; a public proof-of-concept bypass is available at https://github.com/nedlir/skills-scanner-bypass, so assume the technique is known and reproduce it against a staging scanner after upgrading to confirm the bypass is closed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-693 (Protection Mechanism Failure) and lives in the static-analysis component of ClawScan, an OpenClaw skill and plugin scanner. The function shouldSkipTargetPath in internal/runner/runner.go is responsible for deciding which files and directories the built-in deterministic scanner will inspect; a manipulation of the input path causes this routine to classify a target as skippable, so the scanner never evaluates it. The upstream fix (PR 41 / commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa) shows the class of content that previously slipped through: the scanner's documentation was updated to state that packaged Python bytecode is now flagged as opaque executable content, indicating that opaque compiled artifacts were previously allowed to evade static inspection. Because the weakness is a logic/allow-list classification error rather than a memory-safety bug, the attacker gains no code execution through the flaw itself - only the ability to have malicious or opaque content pass a security gate. Only deployments that run the clawscan-static scanner are relevant; the CPE entry cpe:2.3:a:openclaw:clawscan:*:*:*:*:*:*:*:* does not fully encode the version boundary, so the description's 'up to 0.1.6' should be treated as the authoritative affected range.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local attacker with low privilege supplies crafted scan content (AV:L/PR:L); the bypass only weakens detection integrity (I:L), with no direct confidentiality or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB