PT-2026-27222 · Openclaw · Openclaw

Tdjackey · CVE-2026-27183 · Publicado 2026-03-09 · Atualizado 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.7

Description OpenClaw contains a flaw in its system.run dispatch-wrapper handling that allows attackers to bypass shell wrapper approval requirements. The issue arises because the approval classifier and execution planner use different depth-boundary rules. Specifically, using four transparent dispatch wrappers, such as repeated env invocations, before /bin/sh -c can bypass security=allowlist approval gating by misaligning classification with execution planning. The system.run function is involved in this issue.

Recommendations Update OpenClaw to version 2026.3.7 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-436

CWE-863

Identificadores relacionados

CVE-2026-27183

GHSA-R6QF-8968-WJ9Q

Produtos afetados

Openclaw

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27183.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r6qf-8968-wj9q · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/2fc95a7cfc1eb9306356510b0251b6d51fb1c0b0 · Correção
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.7 · Nota
• https://osv.dev/vulnerability/CVE-2026-27183 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r6qf-8968-wj9q · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27183 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2036321646018019715 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-mar-shell-approval-gating-bypass-via-dispatch-wrapper-depth-mismatch · Nota