{"id":"CVE-2026-25593","aliases":["EUVD-2026-5577","GHSA-g55j-c2v4-pjcg"],"status":"published","title":"OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply","description":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00715,"percentile":0.54227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-306","CWE-78"],"published":"2026-02-04T20:06:46Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.1.20"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.1.20"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.1.20"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25593","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g55j-c2v4-pjcg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25593.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25593","title":"OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply","description":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.","status":"published","published":"2026-02-06T20:56:02.824Z","modified":"2026-02-09T15:27:48.829Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5577","description":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.","status":"published","published":"2026-02-06T20:56:02Z","modified":"2026-02-09T15:27:48Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:42.465921Z"}],"ghsa":[{"id":"GHSA-g55j-c2v4-pjcg","title":"OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply","description":"### Summary\n\nAn unauthenticated local client could use the Gateway WebSocket API to write config via `config.apply` and set unsafe `cliPath` values that were later used for command discovery, enabling command injection as the gateway user.\n\n### Impact\n\nA local process on the same machine could execute arbitrary commands as the gateway process user.\n\n### Details\n\n- `config.apply` accepted raw JSON and wrote it to disk after schema validation.\n- `cliPath` values were not constrained to safe executable names/paths.\n- Command discovery used a shell invocation when resolving executables.\n\n### Mitigation\n\nUpgrade to a patched release. If projects cannot upgrade immediately, set `gateway.auth` and avoid custom `cliPath` values.","status":"published","published":"2026-02-04T20:06:46Z","modified":"2026-02-06T21:43:42Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-78","CWE-306"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2026-25593","description":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.","status":"published","published":"2026-02-06T21:16:17.79Z","modified":"2026-06-17T10:24:55.13Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25593","title":"OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply","description":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.","status":"published","published":"2026-02-06T20:56:02.824Z","modified":"2026-10-28T02:30:45.314164931Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-g55j-c2v4-pjcg","title":"OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply","description":"### Summary\n\nAn unauthenticated local client could use the Gateway WebSocket API to write config via `config.apply` and set unsafe `cliPath` values that were later used for command discovery, enabling command injection as the gateway user.\n\n### Impact\n\nA local process on the same machine could execute arbitrary commands as the gateway process user.\n\n### Details\n\n- `config.apply` accepted raw JSON and wrote it to disk after schema validation.\n- `cliPath` values were not constrained to safe executable names/paths.\n- Command discovery used a shell invocation when resolving executables.\n\n### Mitigation\n\nUpgrade to a patched release. If projects cannot upgrade immediately, set `gateway.auth` and avoid custom `cliPath` values.","status":"published","published":"2026-02-04T20:06:46Z","modified":"2026-02-06T22:21:37.548843Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-306","CWE-78"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}