← Back to CVEs

CVE-2026-31993

MEDIUM

4.8

Description

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.

CVE Details

CVSS v3.1 Score4.8

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredHIGH

User InteractionREQUIRED

Published3/19/2026

Last Modified3/19/2026

Sourcenvd

Honeypot Sightings0

Affected Products

openclaw:openclaw

Weaknesses (CWE)

CWE-184

References

https://github.com/openclaw/openclaw/commit/5da03e622119fa012285cdb590fcf4264c965cb5(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/commit/e371da38aab99521c4e076cd3d95fd775e00b784(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chains(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.