Vulnerability Description
OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.28 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxgVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-Third Party Advisory
FAQ
What is CVE-2026-41380?
CVE-2026-41380 is a vulnerability with a CVSS score of 7.3 (HIGH). OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targe...
How severe is CVE-2026-41380?
CVE-2026-41380 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41380?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.