PT-2026-31977 · Openclaw · Openclaw

Edward-X · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35666

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description A flaw exists in OpenClaw that allows attackers to bypass restrictions on executable bindings. This is achieved by misusing time wrappers within the system.run approvals functionality. Specifically, the vulnerability lies in the failure to properly unwrap /usr/bin/time wrappers, enabling an allowlist bypass. Attackers can reuse approval state for inner commands by utilizing an unregistered time wrapper.

Recommendations Update to version 2026.3.22 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-706

CWE-863

Related Identifiers

CVE-2026-35666

GHSA-QM9X-V7CX-7RQ4

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qm9x-v7cx-7rq4 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/39409b6a6dd4239deea682e626bac9ba547bfb14 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35666 · Security Note
• https://osv.dev/vulnerability/GHSA-qm9x-v7cx-7rq4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CveFindCom/status/2042659778988569080 · Twitter Post
• https://twitter.com/CVEnew/status/2042710244984328448 · Twitter Post
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-unregistered-time-dispatch-wrapper · Note