PT-2026-35802 · Openclaw · Openclaw

Keensecuritylab · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-42423

Mitre

CVSS v3.1

7.5

High

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.

Fix

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-42423

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-q2gc-xjqw-qp89 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42423 · Security Note
• https://vulncheck.com/advisories/openclaw-strictinlineeval-approval-boundary-bypass-via-approval-timeout-fallback · Note
• https://twitter.com/CVEnew/status/2049227500299960657 · Twitter Post