Skip to content
CVSS 6.7 · MEDIUM

CVE-2026-41392

OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist matching restrictions.

View on NVD

Severity

Score: 6.7(MEDIUM)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
AV: LOCAL
AC: HIGH
PR: LOW
UI: REQUIRED
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-184

EPSS

Probability of exploitation (next 30 days): 0.0002 (0.0%)
Percentile: 5.8%
EPSS: 2026-05-06

Affects

openclaw:openclaw

Technical description

OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist matching restrictions.

Published: 4/28/2026, 7:37:42 PM
Last modified: 4/30/2026, 8:42:43 PM

References

HomeEventsBlogResourcesTeam