PT-2026-49035

CVE-2026-53831

Published

2026-06-12

Updated

2026-07-02

Description by

CVSS 3.1

8.3

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18

Description A policy enforcement issue exists in the system.run safe-bin allowlist validation on POSIX nodes. This flaw allows shell expansion to modify how commands are interpreted. Authenticated operators can use shell metacharacters within approved commands to read unintended node-local files and expose sensitive configuration data.

Recommendations Update to version 2026.5.18.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-284: Improper Access Control

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor