What’s Vulnerable › Vulnerabilities

CVE-2026-22175: OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-18 · updated 2026-06-17
• Weakness: CWE-184

Description

OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands. Attackers can exploit this by invoking arbitrary payloads under the same multiplexer wrapper to satisfy stored allowlist rules, bypassing intended execution restrictions.

Affected products

• OpenClaw: before 2026.2.23 — fixed in 2026.2.23

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.23. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/a67689a7e3ad494b6637c76235a664322d526f9e
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gwqp-86q6-w47g
• https://www.vulncheck.com/advisories/openclaw-exec-approval-bypass-via-unrecognized-multiplexer-shell-wrappers

Get alerted when CVE-2026-22175 or the next vulnerability affects your stack