CVE-2026-41390CWE-807

OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

High · published April 28, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00162 · 5.1th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper
    cvelistv5