PT-2026-57901 · Openclaw · Openclaw

Chinmohan Nayak · Publicado 2026-07-13 · Atualizado 2026-07-13 · CVE-2026-62199

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2026-62199

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-authentication-bypass-via-environment-filtering · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-62199 · Nota de Segurança