OpenClaw EUVD-2026-87467

Exploitation requires all of the following: the OpenClaw host must be Windows and running in exec allowlist mode; a PowerShell command must have been previously approved that references an executable by bare name (unqualified, PATH-resolved); lower-trust content must be able to write an executable with that same approved basename into an agent-writable workspace directory; and the attacker must be able to steer the approved agent into re-running that command. Limiting factors: local attack vector (AV:L), high complexity plus an attack requirement (AC:H/AT:P), an existing operator allowlist approval and agent-steering interaction (PR:L/UI:P), and non-default reliance on bare executable names - the documented workarounds (avoid bare names, keep executables out of workspaces) directly remove the precondition. The approved executable itself does not need to be replaced.

This is a real but heavily-gated privilege/execution issue rather than a broadly exploitable critical flaw, and the signals are internally consistent. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:P) correctly reflects that exploitation is local, high-complexity, requires an attack precondition (an executable placed in an agent-writable workspace), needs prior privileges (PR:L - the attacker must supply lower-trust content the agent will act on), and depends on user/operator interaction (UI:P - a pre-existing exec-allowlist approval and a steered command). Technical impact is high (VC:H/VI:H/VA:H = arbitrary code execution as the Gateway/node-host user), which is why the 5.4 base score feels low relative to RCE - the score is depressed by the compounding preconditions, not by weak impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or automatable exploitation; this reads as a targeted, chain-dependent weakness. CWE-426 (Untrusted Search Path / workspace-shadow) is the correct classification. Priority is MEDIUM at most: the impact is genuine RCE, but the requirement for a prior allowlist approval, agent-writable workspace, bare-executable-name usage, AND Windows-specific PowerShell analysis makes real-world exploitation narrow.

An attacker feeds lower-trust content to an OpenClaw agent on a Windows host running in exec allowlist mode, causing a malicious executable with an already-approved basename (e.g. a common tool name) to be written into the agent-writable workspace directory. The attacker then steers the agent into running a previously-approved PowerShell command that references the executable by bare name; OpenClaw resolves and runs the workspace copy instead of the allowlisted PATH binary, executing arbitrary code as the Gateway or node-host user. No public exploit code is identified at time of analysis, and the approved executable itself never has to be replaced.