← All Advisories

OpenClaw Execution Approval Mechanism Trusts Carrier Wrapper Executables Rather Than Invoked Targets, Allowing Broader Allowlist Entries Than Intended

Last refreshed2026-09-30

Status: UPDATED  |  Advisory ID: CVE-2026-41380

Key Details

CVECVE-2026-41380
CVSS Score / Version7.3 (High) / CVSS v3.1
Updated2026-06-17
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS Proseattack vector is local; attack complexity is low; privileges required is low; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsopenclaw openclaw
Classified asCWE-807 (Reliance on Untrusted Inputs in a Security Decision)

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
openclawopenclaw
SubsystemsGeneral OT
SectorsMultiple

What to Know

OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries. (NVD)

What to Do

Monitor openclaw's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-41380
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-41380
Vendor advisoryhttps://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg