What’s Vulnerable › Vulnerabilities

CVE-2026-101882: OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-01
• Weakness: CWE-184

Description

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.

Affected products

• OpenClaw Windows Node: before 2026.7.1 — fixed in 2026.7.1

How to fix

Upgrade to a fixed version: OpenClaw Windows Node 2026.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853
• https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656
• https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a
• https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1
• https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp
• https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq
• https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-system-execapprovals-set
• https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp
• https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq

Get alerted when CVE-2026-101882 or the next vulnerability affects your stack