Which versions of Openclaw are affected by CVE-2026-29607?

CVE-2026-29607 presents moderate security risk, a OS command injection vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-29607?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Openclaw CVE-2026-29607

Q: What is the CVSS score of CVE-2026-29607?

CVE-2026-29607 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-13015 HIGH

OS Command Injection (CWE-78)

2026-03-19 VulnCheck

GHSA-6j27-pc5c-m8w8

RCE Command Injection Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13015

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

Patch released

Mar 19, 2026 - 01:30 nvd

Patch available

CVE Published

Mar 19, 2026 - 01:00 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating inner executable intent. Remote attackers can approve benign wrapped system.run commands and subsequently execute different payloads without approval, enabling remote code execution on gateway and node-host execution flows.

AnalysisAI

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in its allow-always wrapper persistence mechanism that enables remote code execution. Attackers with high privileges and user interaction can approve benign wrapped system.run commands, then subsequently execute arbitrary different payloads without requiring additional approval, compromising both gateway and node-host execution environments. A patch is available from the vendor, and this vulnerability is tagged as enabling both RCE and command injection attacks.

Technical ContextAI

The vulnerability exists in OpenClaw's wrapper-level allowlist persistence logic, which is documented as part of the allow-always wrapper feature. The root cause is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that the system fails to properly validate the intent of inner executables when wrapper-level approvals are cached. Instead of validating each execution request against the actual payload being run, the system persists approval decisions at the wrapper level, allowing attackers to approve a benign command and then substitute a malicious payload that reuses the same wrapper context. This affects OpenClaw across all affected versions as identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, and the flaw impacts both remote gateway execution flows and local node-host execution flows.

RemediationAI

Immediately upgrade OpenClaw to version 2026.2.22 or later, which includes the security patch addressing the wrapper persistence authorization bypass. The patch can be obtained from the official GitHub repository at https://github.com/openclaw/openclaw/commit/24c954d972400f508814532dea0e4dcb38418bb0. Until patching is completed, organizations should restrict high-privilege user access to OpenClaw approval workflows, enforce strict code review processes for wrapped system.run command approvals, and disable the allow-always wrapper feature if operationally feasible. Additionally, implement network segmentation to limit exposure of OpenClaw gateways and node hosts to trusted administrative networks only, and enable comprehensive audit logging of all wrapper approvals and command execution events to detect suspicious approval-then-execute patterns.