PT-2026-49778 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53861

Mitre

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command execution depending on operator configuration.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-53861

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-c226-q6fx-6j6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53861 · Security Note
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-combined-posix-inline-flags-on-macos · Note