CVE-2026-101880CWE-863broken-access-control

CVE-2026-101880

High · published October 1, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00685 · 52.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-01T00:17Z
References (7)
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253 · [email protected]https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e · [email protected]https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1 · [email protected]https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8 · [email protected]https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh · [email protected]https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-authorization-bypass · [email protected]https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 19:16Z
    OpenClaw Windows Node before 2026.7.1 Authorization Bypass
    cvelistv5