CVE-2026-41380CWE-807

OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables

High · published April 28, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables
    cvelistv5