EUVD-2026-12708
GHSA-5v6x-rfc3-7qfr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments through cmd.exe /c to achieve local command execution on trusted Windows nodes with mismatched audit logs.
AnalysisAI
OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in the system.run function that allows authenticated operators to execute arbitrary commands on Windows systems by appending malicious arguments after cmd.exe /c while the approval audit log records only the benign command text. An authenticated attacker with operator privileges can exploit this to achieve local command execution on trusted Windows nodes with mismatched or incomplete audit trails, enabling information disclosure and lateral movement while evading detection.
Technical ContextAI
The vulnerability exists in OpenClaw's system.run implementation, which processes Windows command execution through cmd.exe /c. The root cause is classified under CWE-88 (Argument Injection), where user-controlled input is insufficiently validated before being passed to command-line interpreters. The approval mechanism validates and logs only the initial command string, but the actual execution allows trailing arguments to be smuggled through to cmd.exe /c without re-validation. This creates a separation between what is approved and logged versus what actually executes. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), a system automation and orchestration platform that manages command execution across Windows infrastructure.
RemediationAI
Upgrade OpenClaw to version 2026.2.21 or later immediately. The vendor has released a patch available at the GitHub commit link (https://github.com/openclaw/openclaw/commit/6007941f04df1edcca679dd6c95949744fdbd4df). Until patching is completed, implement the following interim controls: (1) restrict operator access to the system.run function to only trusted, audited operators; (2) enforce approval workflows that require explicit validation of the full command string including trailing arguments, not just the initial command; (3) implement enhanced logging and monitoring on Windows nodes to detect unexpected cmd.exe invocations with suspicious arguments; (4) segment OpenClaw infrastructure to limit blast radius of command execution; and (5) cross-validate audit logs against actual process execution logs using Windows Event Logging (Event ID 4688 for process creation) to detect approval-execution mismatches.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today