AI agent vulnerability · OpenClaw

CVE-2026-41390: OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

highCVSS 3.1 7.3GHSA-6pfc-6m7w-m8fx

Summary Allow-always persistence did not unwrap /usr/bin/script and similar wrappers to the actual executed target before storing trust decisions. Impact A user approval for one wrapped command could persist trust for a wrapper binary that later executed a different underlying program.

Published Mar 31, 2026 · Updated Apr 28, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.3.24
Fixed in: 2026.3.28
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Allow-always persistence did not unwrap /usr/bin/script and similar wrappers to the actual executed target before storing trust decisions.

Impact

A user approval for one wrapped command could persist trust for a wrapper binary that later executed a different underlying program.

Affected Component

src/infra/dispatch-wrapper-resolution.ts, src/infra/exec-wrapper-resolution.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 83da3cfe31 (infra: unwrap script wrapper approval targets).

Credited to LonggTeng.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries