PT-2026-49765 · Openclaw · Openclaw

Chinmohan Nayak · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53848

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to perform unintended operations.

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2026-53848

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cwpp-5962-q4f6 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-transparent-command-wrappers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53848 · Nota de Segurança