Every CVE Search/ Get API key

CVE-2026-31992

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

7.1 HighFix available

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
Low

Exploit likelihood

0.35%Up 0.3 points since Mar 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Record
CVE-2026-31992
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Weakness
CWE-184
Updated
2026-11-02
EUVDEUVD-2026-13023 7.1

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Record
EUVD-2026-13023
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-48wf-g7cp-gr3m 5.3

OpenClaw has allowlist exec-guard bypass via env -S

Summary

In allowlist mode, system.run guardrails could be bypassed through env -S, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads.

Severity Rationale (Medium)

This issue is rated medium because it is a guardrail/policy bypass in OpenClaw's trusted-operator model, not an authentication boundary break.

  • Authenticated Gateway callers are trusted operators by design.
  • exec approvals/allowlists are operator safety controls.
  • The bug still weakens expected safety behavior and can enable unintended command execution when untrusted content influences tool input.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Vulnerable versions: <= 2026.2.22-2
  • Patched versions: >= 2026.2.23

Latest published npm version checked during triage: 2026.2.22-2.

Technical Impact

When /usr/bin/env is allowlisted, env -S 'sh -c ...' could be treated as allowed non-wrapper argv while runtime still executes shell-wrapper semantics.

Fix Commit(s)

  • a1c4bf07c6baad3ef87a0e710fe9aef127b1f606 (core allowlist/runtime parity hardening)
  • 3f923e831364d83d0f23499ee49961de334cf58b (explicit env -S regressions)

Release Process Note

patched_versions is pre-set to >= 2026.2.23, so this advisory is now public.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-48wf-g7cp-gr3m
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-184, CWE-193
Updated
2026-11-02
NVD 7.1

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Record
CVE-2026-31992
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-184
Updated
2026-11-02
OSV 7.1

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Record
CVE-2026-31992
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-184
Updated
2026-11-02
OSVGHSA-48wf-g7cp-gr3m 5.3

OpenClaw has allowlist exec-guard bypass via env -S

Summary

In allowlist mode, system.run guardrails could be bypassed through env -S, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads.

Severity Rationale (Medium)

This issue is rated medium because it is a guardrail/policy bypass in OpenClaw's trusted-operator model, not an authentication boundary break.

  • Authenticated Gateway callers are trusted operators by design.
  • exec approvals/allowlists are operator safety controls.
  • The bug still weakens expected safety behavior and can enable unintended command execution when untrusted content influences tool input.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Vulnerable versions: <= 2026.2.22-2
  • Patched versions: >= 2026.2.23

Latest published npm version checked during triage: 2026.2.22-2.

Technical Impact

When /usr/bin/env is allowlisted, env -S 'sh -c ...' could be treated as allowed non-wrapper argv while runtime still executes shell-wrapper semantics.

Fix Commit(s)

  • a1c4bf07c6baad3ef87a0e710fe9aef127b1f606 (core allowlist/runtime parity hardening)
  • 3f923e831364d83d0f23499ee49961de334cf58b (explicit env -S regressions)

Release Process Note

patched_versions is pre-set to >= 2026.2.23, so this advisory is now public.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-48wf-g7cp-gr3m
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-184, CWE-193
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.2.23
2026.2.23

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-31992 is a high vulnerability (CVSS 7.1) in Openclaw, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in openclaw 2026.2.23.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open