CVE-2026-91836CWE-1023

CVE-2026-91836

Low · published September 15, 2026

CVSS v3.1
2.8
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
2.8 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
2.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00325 · 24.4th percentile
Weakness
CWE-1023 · Incomplete Comparison with Missing Factors
Published
2026-09-15T19:17Z
References (9)
https://github.com/openclaw/clawscan/ · [email protected]https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa · [email protected]https://github.com/openclaw/clawscan/issues/40 · [email protected]https://github.com/openclaw/clawscan/pull/41 · [email protected]https://github.com/openclaw/clawscan/releases/tag/v0.1.7 · [email protected]https://vuldb.com/cve/CVE-2026-91836 · [email protected]https://vuldb.com/submit/933533 · [email protected]https://vuldb.com/vuln/404072 · [email protected]https://vuldb.com/vuln/404072/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 14:45Z
    OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
    cvelistv5