Exec Allowlist Bypass in OpenClaw by Unknown Vendor

CVE-2026-41390

What is CVE-2026-41390?

An exec allowlist bypass vulnerability exists in OpenClaw versions prior to 2026.3.28. This flaw allows attackers to exploit the system by leveraging the persistence feature that fails to properly validate or unwrap certain wrapper commands, specifically in relation to /usr/bin/script. As a result, an attacker could gain user trust for one wrapped command, which could enable the execution of unauthorized binaries, posing a significant security risk.

References