En resumen
- CVE-2026-41380 es una vulnerabilidad ALTO (CVSS 7.3) que afecta a openclaw (openclaw), openclaw.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.12%, mayor que el 2.2% de las vulnerabilidades.
- Solución: actualizar a 2026.3.28 o posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.28
| 2026.3.28
|
| openclaw npm | < 2026.3.28
| 2026.3.28
|
Description
Summary
Allow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers.
Impact
A one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries.
Affected Component
src/infra/exec-approvals-allowlist.ts
Fixed Versions
- Affected:
<= 2026.3.24
- Patched:
>= 2026.3.28
- Latest stable
2026.3.28 contains the fix.
Fix
Fixed by commit 9ec44fad39 (Exec approvals: reject wrapper carrier allow-always targets).
NVD description
OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free