CVE-2026-31997CWE-367

OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals

Medium · published March 19, 2026

CVSS v4.0
4.4
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling arbitrary command execution.

The record
Technical detail
CVSS v4.0
4.4 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals
    cvelistv5