PT-2026-49778 · Openclaw · Openclaw

Keensecuritylab + 1 · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53861

Mitre

CVSS v3.1

6.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command execution depending on operator configuration.

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2026-53861

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-c226-q6fx-6j6c · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-combined-posix-inline-flags-on-macos · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53861 · Nota de Segurança