CVE-2026-41390 - OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

Back Back to CVE browser

HIGH

OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

Published Apr 28, 2026

7.0

HIGH

CVSS 4.0

EPSS 0.16%

Description

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
Affected
- ≥ 0, < 2026.3.28
Unaffected
- 2026.3.28

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
OpenClaw	OpenClaw	unaffected	Affected ≥ 0, < 2026.3.28 Unaffected 2026.3.28

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.3.28

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-385

CWE-807

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26098
Advisory
https://github.com/advisories/GHSA-6pfc-6m7w-m8fx
Advisory
https://github.com/openclaw/openclaw/commit/83da3cfe31f016841e1deedda1a604696f4c488d
https://github.com/openclaw/openclaw/releases/tag/v2026.3.28
https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx
vendor-advisoryVendor Advisory
https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26098		Advisory
https://github.com/advisories/GHSA-6pfc-6m7w-m8fx		Advisory
https://github.com/openclaw/openclaw/commit/83da3cfe31f016841e1deedda1a604696f4c488d
https://github.com/openclaw/openclaw/releases/tag/v2026.3.28
https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx		vendor-advisoryVendor Advisory
https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper		third-party-advisoryThird Party Advisory