CVE-2026-27566

7.1 highEPSS 0.4%

High (7.1) in openclaw openclaw. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in openclaw 2026.2.22.

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while executing non-allowlisted commands.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclaw:openclaw

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jj82-76v6-933r	npm	openclaw	<2026.2.22	2026.2.22

References

https://github.com/openclaw/openclaw/commit/2b63592be57782c8946e521bc81286933f0f99c7
https://github.com/openclaw/openclaw/security/advisories/GHSA-jj82-76v6-933r
https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-wrapper-binary-unwrapping-in-system-run

Check your stack JSON