PT-2026-26237 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-02 · Atualizado 2026-03-19 · CVE-2026-31997

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description OpenClaw fails to properly validate executable identity for non-path-like argv[0] tokens during system.run approvals. This allows for post-approval executable rebind attacks, where an attacker can modify the PATH resolution after approval to execute a different binary than the operator initially approved, potentially leading to arbitrary command execution. The system.run approvals did not pin executable identity, and path-token commands were not pinned to canonical executable identity (realpath) across approval and execution.

Recommendations Versions prior to 2026.3.1 should be updated to version 2026.3.1 or later.

Correção

Untrusted Search Path

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-426

CWE-367

Identificadores relacionados

BDU:2026-05006

CVE-2026-31997

GHSA-Q399-23R3-HFX4

GHSA-Q86M-697P-H7FH

Produtos afetados

Openclaw

Referências · 10

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q399-23r3-hfx4 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-05006 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q86m-697p-h7fh · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034520387837440049 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31997 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-31997 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034467541989404892 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-executable-rebind-via-unbound-path-token-in-system-run-approvals · Nota
• https://osv.dev/vulnerability/GHSA-q399-23r3-hfx4 · Aviso do Fabricante