What is the CVSS score of CVE-2026-22175?

CVE-2026-22175 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-22175?

OpenClaw versions prior to 2026.2.23 contain a critical authorization bypass vulnerability that allows attackers to execute arbitrary commands despite approved allowlist restrictions.. A patch is available.

How to fix or mitigate CVE-2026-22175?

Within 24 hours: Inventory all systems running OpenClaw and identify instances in allowlist mode; disable allowlist mode if operationally feasible pending patching. Within 7 days: Apply vendor patch to upgrade OpenClaw to version 2026.2.23 or later across all affected systems. Within 30 days: Conduct security audit of systems that ran vulnerable versions to identify any unauthorized access or command execution.

Openclaw CVE-2026-22175

EUVD-2026-12718 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-03-18 VulnCheck

GHSA-gwqp-86q6-w47g

Authentication Bypass Openclaw

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12718

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

Patch released

Mar 18, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:34 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands. Attackers can exploit this by invoking arbitrary payloads under the same multiplexer wrapper to satisfy stored allowlist rules, bypassing intended execution restrictions.

AnalysisAI

OpenClaw contains an execution approval bypass vulnerability in allowlist mode that allows authenticated attackers to circumvent allow-always grants through unrecognized multiplexer shell wrappers like busybox and toybox. Attackers with low-level privileges can invoke arbitrary payloads under these multiplexer wrappers to satisfy stored allowlist rules while executing unintended commands. This affects all OpenClaw versions prior to 2026.2.23, with a patch now available from the vendor.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw) appears to be an execution control or command approval system that implements allowlist-based security controls. The vulnerability is rooted in CWE-184 (Incomplete List of Disallowed Inputs), where the allowlist validation logic fails to recognize and properly handle multiplexer shell wrappers such as busybox and toybox when processing 'sh -c' command invocations. These lightweight, multi-call binary implementations bundle multiple Unix utilities into a single executable and are commonly used in embedded systems and containers. The flaw allows attackers to wrap malicious payloads in these unrecognized shell wrappers, causing the allowlist engine to match against the wrapper itself rather than the actual payload being executed, thereby bypassing the intended security restrictions.

RemediationAI

Upgrade OpenClaw to version 2026.2.23 or later to fully remediate this vulnerability. The vendor has released a patch available at https://github.com/openclaw/openclaw/commit/a67689a7e3ad494b6637c76235a664322d526f9e which addresses the multiplexer shell wrapper bypass issue. Review the official security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gwqp-86q6-w47g for complete upgrade instructions and any additional configuration changes. As an interim mitigation if immediate patching is not possible, review and audit all allowlist rules to explicitly deny or restrict busybox and toybox shell wrapper invocations, implement additional command validation layers, and restrict network access to OpenClaw services to trusted IP ranges only. Monitor execution logs for suspicious 'sh -c' command patterns involving multiplexer binaries.