Which versions of OpenClaw are affected by CVE-2026-41390?

OpenClaw versions before 2026.3.28 contain a privilege escalation vulnerability that allows authenticated local users to circumvent execution controls through wrapper binary persistence, potentially…. A patch is available.

How to fix or mitigate CVE-2026-41390?

24 hours: Identify all systems running OpenClaw and document current version numbers; audit which local user accounts have been granted trust via wrapped commands. 7 days: Implement network or host-based controls restricting local user execution privileges where feasible; review and tighten wrapper binary trust policies to require re-evaluation of underlying executables. 30 days: Upgrade to OpenClaw 2026.3.28 or later once testing validates compatibility; conduct post-upgrade audit of all persistent trust assignments.

OpenClaw CVE-2026-41390

Q: What is the CVSS score of CVE-2026-41390?

CVE-2026-41390 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26098 HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-04-28 VulnCheck

GHSA-6pfc-6m7w-m8fx

Authentication Bypass Openclaw

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 30, 2026 - 20:38 nvd

Patch available

Apr 28, 2026 - 21:01 EUVD

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:04 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

7.3 (HIGH) 7.0 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26098

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

CVE Published

Apr 28, 2026 - 18:09 nvd

HIGH 7.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

AnalysisAI

Privilege escalation in OpenClaw before 2026.3.28 allows local authenticated attackers to bypass execution allowlist controls via wrapper binary persistence. When users grant trust to wrapped commands (e.g., via /usr/bin/script), OpenClaw fails to distinguish the wrapper from the underlying executable, allowing attackers to reuse the wrapper's persistent trust to execute arbitrary unauthorized programs. No active exploitation confirmed (CISA KEV: not listed), but VulnCheck has published technical advisory details. EPSS data not available.

Technical ContextAI

OpenClaw implements an execution allowlist with user-prompted trust decisions that can persist across sessions (allow-always mode). The vulnerability stems from CWE-807 (Reliance on Untrusted Inputs in a Security Decision) where the trust persistence mechanism stores approval for the wrapper binary path (e.g., /usr/bin/script) rather than the actual target executable. Unix command-line wrappers like /usr/bin/script, env, sudo, or timeout are legitimate utilities that execute other programs as arguments. OpenClaw's trust engine does not unwrap these layers to identify the final executable, creating a confused deputy scenario where approval for 'script calculator.sh' incorrectly extends trust to all future 'script malware.elf' invocations.

RemediationAI

Upgrade immediately to OpenClaw 2026.3.28 or later, which implements wrapper unwrapping logic to store trust decisions for final executables rather than intermediate wrapper binaries. Official security advisory and patch details available at https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx. For environments unable to patch immediately, disable allow-always persistence mode and require per-execution approval prompts - this eliminates persistent trust reuse but significantly increases user friction and may impact operational workflows. Alternatively, audit existing allow-always trust decisions by reviewing OpenClaw's trust database for entries matching common wrapper paths (/usr/bin/script, /usr/bin/env, /usr/bin/timeout, /usr/bin/sudo) and revoke these entries, though this requires manual identification of wrapper patterns and does not prevent future abuse until patched. Review VulnCheck technical analysis at https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper for additional detection guidance.