{"id":"CVE-2026-41380","aliases":["GHSA-p4x4-2r7f-wjxg"],"url":"https://o3.security/vulnerability/CVE-2026-41380","summary":"OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables","details":"## Summary\n\nAllow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers.\n\n## Impact\n\nA one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries.\n\n## Affected Component\n\n`src/infra/exec-approvals-allowlist.ts`\n\n## Fixed Versions\n\n- Affected: `<= 2026.3.24`\n- Patched: `>= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `9ec44fad39` (`Exec approvals: reject wrapper carrier allow-always targets`).","published":"2026-04-28T18:09:43.488Z","modified":"2026-08-12T03:51:14.670211144Z","cvss":null,"epss":{"score":0.00124,"percentile":0.02493,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.3.28"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/9ec44fad390f0bc1c29c3cc418b322560cb0222b","label":"openclaw/openclaw@9ec44fa"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41380.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41380"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-wrapper-carrier-executables"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/9ec44fad390f0bc1c29c3cc418b322560cb0222b"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.3.28"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.670211144Z"}}