PT-2026-35774 · Openclaw · Openclaw

Longgteng · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41390

NVD

CVSS v3.1

7.3

High

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2026-41390

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41390 · Security Note
• https://vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper · Note
• https://twitter.com/CVEnew/status/2049227531161649617 · Twitter Post