EUVD-2026-13025
GHSA-5f9p-f3w2-fwch
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.
AnalysisAI
OpenClaw versions before 2026.2.22 contain an allowlist parsing flaw in the macOS companion app that enables authenticated operators with elevated privileges to bypass command execution controls and run arbitrary commands on paired hosts. The vulnerability affects systems with operator.write access and macOS beta nodes, allowing attackers to craft malicious shell-chain payloads that circumvent validation checks. A security patch is available.
Technical ContextAI
The vulnerability resides in OpenClaw's macOS companion application (cpe:2.3:a:openclaw:openclaw), specifically in the allowlist parsing logic used to validate and approve shell command execution chains. The root cause is classified under CWE-184 (Incomplete List of Disallowed Inputs / Allowlist Bypass), indicating that the application's filtering mechanism fails to account for certain payload patterns or encoding variations when validating commands against its security allowlist. The macOS beta node architecture creates a paired trust model where the companion app is expected to enforce execution policies; the parsing mismatch allows attackers to craft polyglot or obfuscated shell chains that pass validation despite containing unauthorized commands. This is a logic flaw rather than a memory safety issue, meaning it occurs at the policy enforcement layer during command parsing and validation.
RemediationAI
Upgrade OpenClaw immediately to version 2026.2.22 or later, which includes the allowlist parsing fixes referenced in the vendor commits. Organizations unable to patch immediately should restrict operator.write privilege assignments to only trusted personnel, disable or isolate macOS beta node deployments if not operationally critical, and implement network segmentation to limit authenticated access to the OpenClaw management interface. Review audit logs for any suspicious shell-chain command attempts from operator accounts, and consider implementing additional shell command filtering at the host OS level (e.g., via osquery or Security Framework hooks on macOS) as a compensating control. For detailed patching guidance and configuration hardening recommendations, consult the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chains.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today