openclaw-cn CVE-2026-19006

Exploitation requires valid low-privilege authentication to the openclaw-cn instance, as confirmed by the CVSS 4.0 PR:L metric - unauthenticated exploitation is not supported by the available data. The attacker must have network access to the openclaw-cn gateway (AV:N) and the Gateway Exec Approval Flow feature must be active and reachable. No additional attack requirements are indicated (AT:N), meaning no race condition, specific timing, or target-side interaction is needed beyond authenticated access. Limiting factors include: the requirement for at least low-privilege credentials, which rules out fully anonymous exploitation; impact is scoped to the vulnerable system only (SC:N/SI:N/SA:N), constraining the blast radius to what the application process can access; and the project's likely niche deployment footprint limits the number of exposed instances. Non-default configurations are not mentioned as prerequisites, so any standard deployment with the exec gateway enabled is potentially affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) scores 5.3, reflecting network-accessible, low-complexity exploitation by a low-privilege authenticated user with no user interaction required. The E:P modifier confirms proof-of-concept code is publicly available, elevating practical risk above the base score alone. No EPSS data was provided, and the vulnerability is not in CISA KEV, suggesting no confirmed widespread exploitation. The impact is bounded - low confidentiality, integrity, and availability on the vulnerable system with no subsequent system scope change - meaning an attacker bypassing the approval flow gains limited command execution within the application's own permission context, not full system compromise. The primary real-world risk is to deployments relying on the exec approval flow as a meaningful access control boundary: if that boundary is the key safeguard against unauthorized command execution, its bypass is operationally significant regardless of the moderate CVSS score. The absence of vendor response to responsible disclosure increases urgency for operators to apply compensating controls.

An attacker with valid low-privilege credentials to an openclaw-cn 2026.2.5 instance sends a crafted request directly to the Gateway Exec Approval Flow endpoint, manipulating the authorization check in src/agents/bash-tools.exec.ts to skip or satisfy the approval gate without legitimate approval. With the bypass in place, the attacker triggers bash command execution through the agent gateway, reading application secrets, manipulating data within the application's permission scope, or disrupting availability of the exec service. A public proof-of-concept demonstrating this technique is available via the GitHub issue linked in the CVE references.