Vulnerability · Published Aug 6, 2026 · Assigned by VulDB
CVE-2026-19006mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization
Medium 6.3
In plain English
A medium-severity incorrect authorization in openclaw-cn from mf-yang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mf-yang | openclaw-cn | 2026.2.5 |
Weakness: CWE-863, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization vdb-entry
- VDB-386389 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-19006 | CVE Analysis and Report third-party-advisory
- Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863) third-party-advisory
- https://github.com/mf-yang/openclaw-cn/issues/563 exploit, issue-tracking
- https://github.com/mf-yang/openclaw-cn/ product