CVE-2026-41380

Katalog CVE

CVSS 7.3 · High EPSS 0,17%

Kerentanan Reliance on Untrusted Inputs in a Security Decision pada openclaw. Skor CVSS 3.1 7.3 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg advisory vendor
• https://www.vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-wrapper-carrier-executables advisory pihak ketiga