High severity · published Sep 30, 2026
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
OpenClaw Windows Node · OpenClaw
before 2026.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101882
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq
patch
https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656
patch
https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a
release-notes
https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853
More from OpenClaw Windows Node
8.8
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
7.5
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
6.5
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
6.5
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
5.4
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present