In breve
- CVE-2026-35666 è una vulnerabilità ALTO (CVSS 8.8) che riguarda openclaw (openclaw), openclaw.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.37%, superiore al 31.4% delle vulnerabilità.
- Correzione: aggiornare a 2026.3.22 o successiva.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
39409b6a6dd4239deea682e626bac9ba547bfb14
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/infra/dispatch-wrapper-resolution.ts now unwraps /usr/bin/time and binds approvals to the real inner executable.
- src/infra/exec-approvals-allow-always.test.ts ships regression coverage for time-wrapper allow-always approval bypasses.
OpenClaw thanks @YLChen-007 for reporting.
NVD description
OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inner commands.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free