PT-2026-35765

CVE-2026-41380

Published

2026-04-01

Updated

2026-05-01

Description by

CVSS 3.1

7.3

High

MetricsAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An execution approval issue exists in exec-approvals-allowlist.ts where allow-always persistence trusts wrapper carrier executables instead of the actual invoked targets. This allows attackers to use positional carrier executable routing through dispatch wrappers to create broader allowlist entries than intended, which weakens execution approval boundaries.

Recommendations Update to version 2026.3.28.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Qclawer

Vendors

Affected products

Weakness enumeration