PT-2026-35765 · Openclaw · Openclaw

Keensecuritylab + 2 · CVE-2026-41380 · Published 2026-04-01 · Updated 2026-05-01

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An execution approval issue exists in exec-approvals-allowlist.ts where allow-always persistence trusts wrapper carrier executables instead of the actual invoked targets. This allows attackers to use positional carrier executable routing through dispatch wrappers to create broader allowlist entries than intended, which weakens execution approval boundaries.

Recommendations Update to version 2026.3.28.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-807

Related Identifiers

CVE-2026-41380

GHSA-P4X4-2R7F-WJXG

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41380.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41380 · Security Note
• https://osv.dev/vulnerability/GHSA-p4x4-2r7f-wjxg · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/9ec44fad390f0bc1c29c3cc418b322560cb0222b · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Note
• https://vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-wrapper-carrier-executables · Note
• https://t.me/cveNotify/161764 · Telegram Post
• https://twitter.com/CVEnew/status/2049227540368122360 · Twitter Post