What is the CVSS score of CVE-2026-29610?

CVE-2026-29610 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-29610?

OpenClaw versions prior to 2026.2.14 contain a critical command execution vulnerability that could allow attackers to run arbitrary code on systems where the software is deployed.. A patch is available.

How to fix or mitigate CVE-2026-29610?

Within 24 hours: Inventory all systems running OpenClaw and identify those on versions prior to 2026.2.14. Within 7 days: Apply vendor patch 2026.2.14 or later to all affected instances, prioritizing production and critical infrastructure systems. Within 30 days: Conduct post-patch verification testing and review access logs for signs of exploitation or suspicious PATH environment variable manipulation.

Openclaw CVE-2026-29610

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-03-05 disclosure@vulncheck.com

GHSA-jqpq-mgvm-f9r6

Privilege Escalation Openclaw

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 11, 2026 - 01:02 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.8

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping. Attackers with authenticated access to node-host execution surfaces or those running OpenClaw in attacker-controlled directories can place malicious executables in PATH to override allowlisted safe-bin commands and achieve arbitrary command execution.

AnalysisAI

Arbitrary command execution in OpenClaw prior to version 2026.2.14 stems from improper PATH validation during node-host execution and project bootstrapping, allowing authenticated attackers or those with local filesystem access to substitute malicious binaries for legitimate commands. An attacker can exploit this to bypass allowlisted command restrictions and achieve code execution with the privileges of the OpenClaw process. A patch is available for versions 2026.2.14 and later.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). Affects Openclaw. OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping. Attackers with authenticated access to node-host execution surfaces or those running OpenClaw in attacker-controlled directories can place malicious executables in PATH to override allowlisted safe-bin commands and achieve arbitrary command execution.