EUVD-2026-36624
GHSA-ffhm-8fwq-7q27
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable operator API, low complexity alias trick, requires authenticated operator (PR:L), no user interaction, full host RCE impact on C/I/A within the OpenClaw service scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.
AnalysisAI
Remote code execution in OpenClaw before 2026.5.12 allows authenticated operators to bypass the PowerShell execution allowlist by submitting encoded-command flag aliases (abbreviated forms) that the allowlist parser fails to recognize. The flaw enables execution of arbitrary PowerShell payloads with full confidentiality, integrity, and availability impact on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the OpenClaw application, (2) valid authenticated operator credentials with permission to submit PowerShell execution tasks (CVSS PR:L), (3) an OpenClaw build prior to 2026.5.12 whose allowlist parser only matches the canonical -EncodedCommand flag, and (4) a Windows host where powershell.exe is the execution backend and resolves abbreviated parameter aliases like -enc/-encodedc/-e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H yields 8.7 (High) and matches the description: network-reachable, low complexity, requires only operator-level authentication, no user interaction, and full triad impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has phished or otherwise obtained valid OpenClaw operator credentials submits an execution task whose command line uses an abbreviated alias such as 'powershell -enc <base64>' instead of the full '-EncodedCommand' form. The allowlist parser does not recognize the alias and admits the request, while powershell.exe resolves the prefix and executes the base64-decoded payload, giving the attacker arbitrary code execution under the OpenClaw service identity. |
| Remediation | Vendor-released patch: upgrade OpenClaw to 2026.5.12 or later, which extends the allowlist parser to canonicalize abbreviated PowerShell flag aliases; see GHSA-j472-gf56-x589 for the upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all OpenClaw deployments and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Command injection in OpenClaw before 2026.5.18 allows authenticated attackers to modify shell wrapper argv between appro
Arbitrary code execution in OpenClaw before 2026.5.27 lets attackers hijack the Homebrew executable resolved during skil
Authentication bypass in OpenClaw before 2026.5.22 allows authenticated network attackers to spoof locality information
Privilege escalation in OpenClaw before 2026.5.18 allows WebSocket-connected Control UI clients to claim operator.admin
Privilege escalation in OpenClaw before 2026.5.20 allows attackers holding a valid hook token to invoke owner-only MCP t
Share
External POC / Exploit Code
Leaving vuln.today