Is there a patch available for EUVD-2026-37150?

Yes, a patch is available for EUVD-2026-37150. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-37150

Q: What is the CVSS score of EUVD-2026-37150?

EUVD-2026-37150 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53848 LOW

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-16 VulnCheck

GHSA-cwpp-5962-q4f6

GHSA-wrr6-p5r6-474m

Authentication Bypass Openclaw

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Operator authentication required (PR:L); AT:P precondition maps to AC:H in 3.1; impact confined to low integrity on the vulnerable system only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 19:05 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to perform unintended operations.

AnalysisAI

OpenClaw before version 2026.5.26 exposes an exec allowlist bypass that lets authenticated operators with low privileges invoke unintended side effects through transparent command wrappers that circumvent allowlist validation at the wrapper layer. The root cause is CWE-184 (Incomplete List of Disallowed Inputs), where allowlist checks succeed at the surface request level but fail to constrain behavior triggered deeper in the wrapper execution path, yielding a limited but confirmed integrity impact on the vulnerable system. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained scope: exploitation requires authenticated operator access plus a specific attack target precondition.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements an exec allowlist designed to restrict which commands authenticated operators may execute at runtime. CWE-184 (Incomplete List of Disallowed Inputs) identifies the root cause class: the validation logic does not fully enumerate or account for all possible inputs reaching the underlying execution layer. Specifically, transparent command wrappers - intermediary layers that proxy or transform operator requests before execution - introduce side effects that fall outside the allowlist's visibility. Because the allowlist inspects the surface-level command intent rather than the full execution graph including wrapper behavior, a crafted request can pass validation while causing the wrapper to perform operations the allowlist was designed to prohibit. This class of flaw is distinct from a simple blocklist omission; it reflects a structural gap where the allowlist boundary and the actual execution boundary are misaligned.

RemediationAI

Upgrade OpenClaw to version 2026.5.26 or later, which is the first release that addresses this allowlist bypass per the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-cwpp-5962-q4f6; additional context is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-transparent-command-wrappers. If immediate patching is not feasible, reduce the operator account surface as a compensating control by auditing and revoking unnecessary low-privilege operator credentials, thereby limiting the pool of accounts that could exploit the wrapper bypass - note this does not close the underlying allowlist gap and should be treated as a temporary measure only. Environments where the exec interface is exposed over the network should also consider whether network-layer access controls (e.g., restricting which hosts can reach the exec endpoint) can further limit exposure, with the trade-off of potential operational disruption to legitimate operator workflows.