CVE-2026-41390

Katalog CVE

CVSS 7.3 · High EPSS 0,16%

Kerentanan Reliance on Untrusted Inputs in a Security Decision pada openclaw. Skor CVSS 3.1 7.3 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx advisory vendor
• https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper advisory pihak ketiga