Vulnerability Description
OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.28 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fxVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistThird Party Advisory
FAQ
What is CVE-2026-41390?
CVE-2026-41390 is a vulnerability with a CVSS score of 7.3 (HIGH). OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers ...
How severe is CVE-2026-41390?
CVE-2026-41390 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41390?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.