High severity · published Sep 30, 2026
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
OpenClaw Windows Node · OpenClaw
before 2026.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101880
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101880
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh
patch
https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e
release-notes
https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-authorization-bypass
More from OpenClaw Windows Node
8.8
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
7.5
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
6.5
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
6.5
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
5.4
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present