Openclaw EUVD-2026-17011

OpenClaw versions before 2026.3.11 with exec allowlist enabled. Attacker exploits glob pattern bypass using '?' wildcards to circumvent path validation. Remote unauthenticated exploitation possible if OpenClaw exposes command execution endpoints without authentication.

The CVSS 4.0 score of 8.8 with vector AV:N/AC:L/AT:N/PR:N/UI:N indicates critical baseline risk: network-accessible exploitation requiring no authentication, low attack complexity, and no user interaction, with high integrity and availability impact. However, real-world risk depends heavily on deployment context. The vulnerability requires that OpenClaw be configured with exec allowlists and exposed to untrusted network inputs, limiting the attack surface compared to universally exploitable flaws. No EPSS score is available in the provided data, and no CISA KEV listing confirms active exploitation, suggesting this remains a theoretical risk without widespread attacker adoption. No public exploit identified at time of analysis, though the technical description provides sufficient detail for skilled attackers to develop exploits. From an SSVC perspective, exploitation status is POC (proof-of-concept based on advisory detail), automatable (yes, given network access and no auth requirements), and technical impact is significant (arbitrary command execution within the context of the application). Organizations running OpenClaw in internet-facing or multi-tenant environments should prioritize remediation, while isolated or fully trusted deployments face lower immediate risk. The authentication bypass tag confirms no credentials are needed, elevating priority for public-facing instances.

An unauthenticated attacker scans for internet-accessible OpenClaw instances and identifies a deployment configured with exec allowlists intended to restrict command execution to approved paths like /usr/bin/approved_tool. The attacker crafts a malicious request containing a command path such as /usr?bin/malicious_script or /usr/b?n/nc, exploiting the ? wildcard's incorrect behavior of matching across path separators. OpenClaw's vulnerable matchesExecAllowlistPattern function incorrectly validates this crafted path as matching the allowlist pattern, bypassing intended restrictions. The attacker successfully executes arbitrary commands with the privileges of the OpenClaw process, potentially establishing reverse shells, exfiltrating sensitive data, or pivoting to adjacent systems depending on the deployment's network position and OpenClaw's runtime permissions. The attack requires no authentication and can be automated once vulnerable instances are identified.