CVE-2026-31992CWE-184

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

High · published March 19, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00644 · 50.2th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S
    cvelistv5