Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-101880OpenClaw Windows Node before 2026.7.1 Authorization Bypass

High 8.8

In plain English

A high-severity incorrect authorization in OpenClaw Windows Node from OpenClaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw Windows Node	0 – before 2026.7.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-r3x2-vf2f-vvj8) vendor-advisory
GitHub Security Advisory (GHSA-vg38-vjq2-vgvh) vendor-advisory
https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e patch
OpenClaw Windows Node v2026.7.1 Release Notes release-notes
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253 technical-description
VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1 Authorization Bypass third-party-advisory