CVE-2026-31993CWE-184

OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains

Medium · published March 19, 2026

CVSS v4.0
5.6
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.

The record
Technical detail
CVSS v4.0
5.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains
    cvelistv5