CVE-2026-91836

0.9 lowEPSS 0.3%

Low (0.9). EPSS 0.3% chance of exploitation in the next 30 days.

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Severity

CVSS 4.0

0.9 low

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

2.8 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-1023
Published: 2026-09-15
Modified: 2026-09-20
Record from: the NVD, synced 2026-10-19

References

https://github.com/openclaw/clawscan/
https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa
https://github.com/openclaw/clawscan/issues/40
https://github.com/openclaw/clawscan/pull/41
https://github.com/openclaw/clawscan/releases/tag/v0.1.7

Check your stack JSON