CVE-2026-41390 HIGH

CVE-2026-41390: OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

Vendor Openclaw
Product OpenClaw
Weakness CWE-807
Published April 28, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs.

Key dates

02Disclosure timeline

April 28, 2026 CVE published
April 29, 2026 Record updated