CVE-2026-31992
HIGHOpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S
Title source: cnaDescription
OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.
References (4)
Core 4
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-48wf-g7cp-gr3m)
https://github.com/openclaw/openclaw/security/advisories/GHSA-48wf-g7cp-gr3m
Patch patch
Patch Commit
https://github.com/openclaw/openclaw/commit/a1c4bf07c6baad3ef87a0e710fe9aef127b1f606
Patch patch
Patch Commit
https://github.com/openclaw/openclaw/commit/3f923e831364d83d0f23499ee49961de334cf58b
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S
https://www.vulncheck.com/advisories/openclaw-allowlist-exec-guard-bypass-via-env-s
Scores
CVSS v3
7.1
EPSS
0.0034
EPSS Percentile
25.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-184
Status
published
Products (3)
npm/openclaw
0 - 2026.2.23npm
OpenClaw/OpenClaw
< 2026.2.23
openclaw/openclaw
< 2026.2.23
Published
Mar 19, 2026
Tracked Since
Mar 19, 2026