AI / ML CVE-2026-39398
MEDIUM
GHSA-7853-gqqm-vcwx
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a medium-to-high real-world risk despite the absence of a CVSS score or publicly weaponized proof-of-concept. The SSVC signal is clear: the exploitation is straightforward (attackers can inject prompts), the impact is severe (arbitrary code execution in gateway process), and the affected population is specifically operators who expose the bridge to untrusted input. The false-security claim in the README is the critical risk multiplier: defenders believe they have sandboxing when they do not, leading to unsafe deployment patterns (e.g., public-facing gateways, automated pipelines with untrusted context). The actual exploitation depends on undocumented Claude Code CLI behavior in --print non-interactive mode (current behavior may deny/error, but future versions could auto-allow), making this a latent vulnerability waiting for a runtime change in the dependency. The privilege-escalation tag and CWE-276 indicate that successful exploitation yields code execution within the hosting process's security context. No CVSS vector is provided, but attack complexity is low (prompt injection via normal input) and attack vector is network (for exposed gateways). The availability of a patched version (v1.1.1) and straightforward fix reinforces that this is a genuine security defect, not a false positive. |
| Exploit ScenarioDerived | An attacker submits a crafted prompt to an openclaw-claude-bridge v1.1.0 instance (e.g., via a public gateway or automated agent pipeline) containing an injection payload such as 'Read /etc/passwd' or 'Bash rm -rf /important/data'. If the underlying Claude Code CLI in --print non-interactive mode auto-allows tool execution or follows future default behavior that permits tools, the subprocess executes the injected command in the process context of the bridge, potentially reading sensitive files, modifying system state, or executing arbitrary shell commands. The attack requires no authentication (the bridge processes untrusted input by design) and normal attack complexity (standard prompt injection). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
openclaw-claude-bridge v1.1.0 incorrectly disables CLI tool access by passing --allowed-tools "" to the Claude Code subprocess, when the correct flag to disable tools is --tools. The --allowed-tools flag only controls which tools auto-approve without prompts; all CLI tools (Read, Write, Bash, WebFetch, etc.) remain nominally available. Users deploying the bridge to handle untrusted prompts or in gateway contexts may unknowingly operate without the sandboxing protections claimed in the README, exposing systems to prompt-injection attacks that could trigger arbitrary code execution in the process context. Vendor-released patch: v1.1.1 (commit 8a296f5).
RemediationAI
Vendor-released patch: upgrade to openclaw-claude-bridge v1.1.1 or later (commit 8a296f5), which corrects the subprocess invocation to use --tools "" instead of --allowed-tools "" and renames the environment variable from CLAUDE_ALLOWED_TOOLS to CLAUDE_TOOLS. For users unable to upgrade immediately, manually edit the dist/cli-bridge.js file to replace the --allowed-tools flag with --tools. Setting the CLAUDE_ALLOWED_TOOLS environment variable on v1.1.0 has no mitigating effect and should not be relied upon. Refer to the patch commit and v1.1.1 release notes at https://github.com/SeaL773/openclaw-claude-bridge/releases/tag/v1.1.1 and the GitHub security advisory at https://github.com/advisories/GHSA-7853-gqqm-vcwx.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The openclaw-claude-bridge (npm package pkg:npm/openclaw-claude-bridge) wraps the Claude Code CLI by spawning a subprocess with configuration flags. The vulnerability stems from a misunderstanding of Claude Code CLI's command-line interface: the --allowed-tools flag (per official documentation) specifies an auto-approve allowlist for tool execution without permission prompts, while the --tools flag controls which tools from the built-in set are actually available. The bridge's v1.1.0 passes --allowed-tools "" believing this disables all tools, but per the Claude Code CLI reference documentation, the correct incantation is --tools "" to disable tools entirely. The underlying issue is CWE-276 (Incorrect Default Permissions), as the code makes a security claim (README documentation) that does not match the actual implementation behavior. The root cause is reliance on incorrect understanding of a dependency's API contract.
Know when AI / ML gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Lifecycle Timeline
2DescriptionCVE.org
Affected
openclaw-claude-bridge v1.1.0
Issue
v1.1.0 spawns the Claude Code CLI subprocess with --allowed-tools "" and the release notes + README claim this "disables all CLI tools" for sandboxing. This claim is incorrect.
Per the Claude Code CLI documentation, --allowed-tools (alias --allowedTools) is an auto-approve allowlist of tools that execute without permission prompts - NOT a restriction on which tools are available. The correct flag to restrict the available tool set is --tools:
> --tools <tools...> Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").
Impact
- All CLI tools (Read/Write/Bash/WebFetch/...) remain nominally available to the spawned subprocess.
- Actual execution behavior in
--printnon-interactive mode depends on undocumented CLI defaults (may auto-deny, may error out, may hang). - Users who deploy the bridge behind any interface that forwards untrusted prompts (e.g., publicly exposed OpenClaw gateway, automated pipelines with web-fetched context, agents that consume tool results from other systems) may be relying on a sandbox that does not exist.
The README explicitly makes a security claim the code does not uphold, creating a false sense of safety for downstream operators. If the underlying CLI behavior changes in a future version to auto-allow tools in --print mode, prompt-injection attacks could trigger arbitrary Read/Write/Bash operations in the gateway's process context.
Patches
Fixed in v1.1.1 (commit 8a296f5) by switching to --tools "". The environment variable was also renamed from CLAUDE_ALLOWED_TOOLS to CLAUDE_TOOLS to match the flag.
Workarounds
Setting CLAUDE_ALLOWED_TOOLS on v1.1.0 has no mitigating effect. Upgrade to v1.1.1 or manually edit dist/cli-bridge.js to replace --allowed-tools with --tools.
References
- Fix: https://github.com/SeaL773/openclaw-claude-bridge/commit/8a296f5
- v1.1.1 notes: https://github.com/SeaL773/openclaw-claude-bridge/releases/tag/v1.1.1
- Claude Code CLI reference: https://docs.claude.com/en/docs/claude-code/cli-reference
Credit
Found during a second-round code review.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
MCPJam Inspector versions 1.4.2 and earlier allow unauthenticated remote code execution through missing authentication i
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the e
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Er
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
Exploit-DB