OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply

高 8.4CVE-2026-25593 · GHSA-g55j-c2v4-pjcg · 06/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-25593 は openclaw (openclaw), openclaw に影響する深刻度「高」 (CVSS 8.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.71%（全脆弱性の 53.9% より高い）。
対処：2026.1.20 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.1.20`	`2026.1.20`
openclaw npm	`< 2026.1.20`	`2026.1.20`

概要

Summary

An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user.

Impact

A local process on the same machine could execute arbitrary commands as the gateway process user.

Details

config.apply accepted raw JSON and wrote it to disk after schema validation.
cliPath values were not constrained to safe executable names/paths.
Command discovery used a shell invocation when resolving executables.

Mitigation

Upgrade to a patched release. If projects cannot upgrade immediately, set gateway.auth and avoid custom cliPath values.

NVD の説明

OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.