CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.
| CWE | CWE-184 |
| Vendor | openclaw |
| Product | openclaw windows node |
| Published | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw windows node
Be the first to know when new high vulnerabilities affecting openclaw openclaw windows node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
OpenClaw / OpenClaw Windows Node
0 < 2026.7.1
References
github.com: https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp github.com: https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq github.com: https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656 github.com: https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a github.com: https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1 github.com: https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-system-execapprovals-set
Credits
Cameron Beeley (anagnorisis2peripeteia)