CVE-2026-41390

HIGH

7.3

Beschreibung

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

CVE Details

CVSS v3.1 Bewertung7.3

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionREQUIRED

Veroffentlicht4/28/2026

Zuletzt geandert4/30/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

openclaw:openclaw

Schwachen (CWE)

CWE-807

Referenzen

https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.