Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-101884 (GCVE-0-2026-101884)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:33

Title

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

Summary

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:33 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101884",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:33:07.973543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:33:24.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:25.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:04.686Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-39cf-qcfw-g8pg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/261ba11aaad671834ad141bb85101b50cf1a38f6"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecEnvSanitizer.cs#L15-L50"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-environment-override"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101884",
    "datePublished": "2026-09-30T19:16:04.686Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:33:24.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101883 (GCVE-0-2026-101883)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

Summary

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , ≤ 2026.9.4 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThanOrEqual": "2026.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node\u0027s WebView send requests to localhost, private networks, or tailnet services from the user\u0027s machine."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:03.985Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7vch-pmw9-3g4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v2026.9.4/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1244-L1270"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Tray.WinUI/Windows/CanvasWindow.xaml.cs#L77-L109"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-through-2026.9.4-ssrf-via-canvas-present"
        }
      ],
      "title": "OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101883",
    "datePublished": "2026-09-30T19:16:03.985Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:03.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101882 (GCVE-0-2026-101882)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set

Summary

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

VulnCheck mitre root Scorecard

References

7 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:21.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:03.309Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-f32j-8759-w2fp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp"
        },
        {
          "name": "GitHub Security Advisory (GHSA-g95v-c9r6-2hmq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-system-execapprovals-set"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101882",
    "datePublished": "2026-09-30T19:16:03.309Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:03.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101881 (GCVE-0-2026-101881)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:53

Title

OpenClaw Windows Node before 2026.7.1 Denial of Service

Summary

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:53 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101881",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:53:03.562709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:53:47.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:02.477Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xxr2-xm56-9cw5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101881",
    "datePublished": "2026-09-30T19:16:02.477Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:53:47.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101880 (GCVE-0-2026-101880)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:34

Title

OpenClaw Windows Node before 2026.7.1 Authorization Bypass

Summary

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:33 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101880",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:33:47.048317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:34:05.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:01.717Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r3x2-vf2f-vvj8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8"
        },
        {
          "name": "GitHub Security Advisory (GHSA-vg38-vjq2-vgvh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-authorization-bypass"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Authorization Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101880",
    "datePublished": "2026-09-30T19:16:01.717Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:34:05.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101879 (GCVE-0-2026-101879)

Vulnerability from nvd – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

Summary

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1-3 (custom)

Date Public

2026-09-03 05:31

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1-3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:31:51.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:01.014Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fxch-cgcp-4v5h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1-3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101879",
    "datePublished": "2026-09-30T19:16:01.014Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:01.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101884 (GCVE-0-2026-101884)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:33

Title

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

Summary

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:33 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101884",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:33:07.973543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:33:24.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:25.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:04.686Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-39cf-qcfw-g8pg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/261ba11aaad671834ad141bb85101b50cf1a38f6"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecEnvSanitizer.cs#L15-L50"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-environment-override"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101884",
    "datePublished": "2026-09-30T19:16:04.686Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:33:24.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101883 (GCVE-0-2026-101883)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

Summary

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , ≤ 2026.9.4 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThanOrEqual": "2026.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node\u0027s WebView send requests to localhost, private networks, or tailnet services from the user\u0027s machine."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:03.985Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7vch-pmw9-3g4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v2026.9.4/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1244-L1270"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Tray.WinUI/Windows/CanvasWindow.xaml.cs#L77-L109"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-through-2026.9.4-ssrf-via-canvas-present"
        }
      ],
      "title": "OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101883",
    "datePublished": "2026-09-30T19:16:03.985Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:03.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101882 (GCVE-0-2026-101882)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set

Summary

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

VulnCheck mitre root Scorecard

References

7 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:21.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:03.309Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-f32j-8759-w2fp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp"
        },
        {
          "name": "GitHub Security Advisory (GHSA-g95v-c9r6-2hmq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-system-execapprovals-set"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101882",
    "datePublished": "2026-09-30T19:16:03.309Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:03.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101881 (GCVE-0-2026-101881)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:53

Title

OpenClaw Windows Node before 2026.7.1 Denial of Service

Summary

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:53 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101881",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:53:03.562709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:53:47.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:02.477Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xxr2-xm56-9cw5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101881",
    "datePublished": "2026-09-30T19:16:02.477Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:53:47.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101880 (GCVE-0-2026-101880)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:34

Title

OpenClaw Windows Node before 2026.7.1 Authorization Bypass

Summary

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:33 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1 (custom)

Date Public

2026-09-03 05:32

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101880",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:33:47.048317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:34:05.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:32:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:01.717Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r3x2-vf2f-vvj8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8"
        },
        {
          "name": "GitHub Security Advisory (GHSA-vg38-vjq2-vgvh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-authorization-bypass"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1 Authorization Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101880",
    "datePublished": "2026-09-30T19:16:01.717Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:34:05.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101879 (GCVE-0-2026-101879)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16

Title

OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

Summary

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/openclaw/openclaw-windows-node…	vendor-advisory
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	patch
https://github.com/openclaw/openclaw-windows-node…	release-notes
https://github.com/openclaw/openclaw-windows-node…	technical-description
https://www.vulncheck.com/advisories/openclaw-win…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw Windows Node	Affected: 0 , < 2026.7.1-3 (custom)

Date Public

2026-09-03 05:31

Credits

Cameron Beeley (anagnorisis2peripeteia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenClaw Windows Node",
          "repo": "https://github.com/openclaw/openclaw-windows-node",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.7.1-3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cameron Beeley (anagnorisis2peripeteia)"
        }
      ],
      "datePublic": "2026-09-03T05:31:51.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:16:01.014Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fxch-cgcp-4v5h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b"
        },
        {
          "name": "OpenClaw Windows Node v2026.7.1-3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization"
        }
      ],
      "title": "OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101879",
    "datePublished": "2026-09-30T19:16:01.014Z",
    "dateReserved": "2026-09-28T15:44:45.389Z",
    "dateUpdated": "2026-09-30T19:16:01.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities found for OpenClaw Windows Node by OpenClaw

CVE-2026-101884 (GCVE-0-2026-101884)

CVE-2026-101883 (GCVE-0-2026-101883)

CVE-2026-101882 (GCVE-0-2026-101882)

CVE-2026-101881 (GCVE-0-2026-101881)

CVE-2026-101880 (GCVE-0-2026-101880)

CVE-2026-101879 (GCVE-0-2026-101879)

CVE-2026-101884 (GCVE-0-2026-101884)

CVE-2026-101883 (GCVE-0-2026-101883)

CVE-2026-101882 (GCVE-0-2026-101882)

CVE-2026-101881 (GCVE-0-2026-101881)

CVE-2026-101880 (GCVE-0-2026-101880)

CVE-2026-101879 (GCVE-0-2026-101879)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities found for OpenClaw Windows Node by OpenClaw

CVE-2026-101884 (GCVE-0-2026-101884)

CVE-2026-101883 (GCVE-0-2026-101883)

CVE-2026-101882 (GCVE-0-2026-101882)

CVE-2026-101881 (GCVE-0-2026-101881)

CVE-2026-101880 (GCVE-0-2026-101880)

CVE-2026-101879 (GCVE-0-2026-101879)

CVE-2026-101884 (GCVE-0-2026-101884)

CVE-2026-101883 (GCVE-0-2026-101883)

CVE-2026-101882 (GCVE-0-2026-101882)

CVE-2026-101881 (GCVE-0-2026-101881)

CVE-2026-101880 (GCVE-0-2026-101880)

CVE-2026-101879 (GCVE-0-2026-101879)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.