PT-2026-49024 · Openclaw · Openclaw
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.5.12
Description
An exec denylist bypass exists in the bundle MCP loopback session-spawn path. This allows authenticated callers to bypass intended command restrictions and start sessions with broader command reach than intended.
Recommendations
Update to version 2026.5.12.
Exploit
Fix
Missing Authorization
Improper Access Control
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw