Which versions of OpenClaw are affected by EUVD-2026-37157?

OpenClaw before version 2026.4.2 contains an allowlist bypass vulnerability that enables authenticated operators to execute unapproved shell commands, creating risk of unauthorized data access and…. A patch is available.

How to fix or mitigate EUVD-2026-37157?

Within 24 hours: Inventory OpenClaw deployments and document current versions in use; review operator activity logs for suspicious or unexpected shell command executions. Within 7 days: Restrict authenticated operator privileges to minimum necessary roles; implement alerting on operator command execution patterns. Within 30 days: Monitor vendor advisories for patch availability; deploy version 2026.4.2 or later immediately upon release.

OpenClaw EUVD-2026-37157

Q: What is the CVSS score of EUVD-2026-37157?

EUVD-2026-37157 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-53855 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-16 VulnCheck

GHSA-27pq-2ph8-8x25

GHSA-5cj2-3jr2-5h77

Authentication Bypass Openclaw

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable post-auth operator (PR:L); crafting a positional-parameter bypass of an allowlist is a non-trivial attack condition (AC:H); arbitrary command smuggling yields C:H/I:H but no stated availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:52 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.2.

DescriptionCVE.org

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.

AnalysisAI

Allowlist bypass in OpenClaw before 2026.4.2 lets authenticated operators smuggle inline-eval content through shell positional parameters, defeating the strict allowlist that is meant to constrain which tools and content the shell carrier executes. Successful abuse yields execution of unapproved shell-provided content with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.

Technical ContextAI

OpenClaw enforces a strict allowlist over the tools and inline-eval content that can be passed to a shell carrier. The vulnerability is an instance of CWE-184 (Incomplete List of Disallowed Inputs): the allowlist matcher inspects the explicit tool arguments but does not account for shell positional parameters ($1, $2, $@, etc.), which the shell expands at runtime. By combining an allowlisted tool invocation with positional arguments that carry attacker-controlled inline-eval payloads, the eval content rides into the shell carrier outside the allowlist's intended rule scope. The CPE confirms the impact is scoped to the openclaw:openclaw package itself, with the broken check living in the inline-eval/allowlist enforcement path rather than in the underlying shell.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.4.2 or later, per the project GHSA-5cj2-3jr2-5h77 advisory. Until the upgrade is rolled out, restrict operator credentials to trusted users and audit operator-supplied tool invocations for shell positional parameter usage ($1, $2, $@, $*, ${n}) in arguments to allowlisted tools, since the bug requires those constructs to smuggle inline-eval content; rejecting or stripping positional-parameter tokens from operator inputs blocks the known bypass but will break any legitimate workflow that relies on positional expansion. Tightening the allowlist to refuse argument strings containing unescaped shell metacharacters provides additional defense-in-depth at the cost of legitimate command flexibility, and operator action logs should be reviewed for prior abuse before patching. Cross-reference the VulnCheck write-up (https://www.vulncheck.com/advisories/openclaw-shell-positional-parameters-bypass-in-inline-eval-checks) for indicators.