EUVD-2026-53730
GHSA-p2px-f69r-9h28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; low privileges required per CVSS 4.0 PR:L; no scope change; all impacts limited to low consistent with CVSS 4.0 VC/VI/VA:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approval Flow, circumventing the intended control that governs bash command execution through the agent gateway. The flaw resides in src/agents/bash-tools.exec.ts and is classified as CWE-863 (Incorrect Authorization). No public exploit identified at time of analysis is incorrect here - a proof-of-concept is publicly available via GitHub issue #563, though CISA KEV listing is absent, indicating no confirmed mass exploitation at time of analysis.
Technical ContextAI
openclaw-cn (CPE: cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*) appears to be an AI agent framework that routes tool-level bash execution through a gateway approval mechanism implemented in src/agents/bash-tools.exec.ts. CWE-863 (Incorrect Authorization) denotes that the system performs an authorization check but applies it incorrectly - the approval flow gate is present but can be manipulated or bypassed without satisfying its intended prerequisites. This is distinct from missing authorization (CWE-862); the control exists but is logically flawed, allowing a low-privileged authenticated user to invoke exec-level functionality that should require explicit approval. The TypeScript source path and component naming suggest a Node.js-based backend agent runtime.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was notified via GitHub issue #563 but has not responded. The most effective compensating control is to disable or isolate the Gateway Exec Approval Flow feature entirely, accepting loss of exec-gateway functionality as a trade-off. If exec functionality must remain active, enforce strict network-level access controls to limit which authenticated users can reach the exec gateway endpoint, reducing the attack surface to the minimum required set of users. Application-layer logging of all exec gateway invocations should be enabled immediately to detect unauthorized bypass attempts. Operators should monitor the project repository at https://github.com/mf-yang/openclaw-cn/ and VulDB entry https://vuldb.com/vuln/386389 for any upstream patch or advisory. Pinning to a known-good version and auditing the authorization logic in src/agents/bash-tools.exec.ts manually are additional options for teams with TypeScript capability.
More in Openclaw Cn
View allSymlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traver
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privile
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated re
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today