CVE-2026-29607
Published: 19 March 2026
Summary
CVE-2026-29607 is a high-severity OS Command Injection (CWE-78) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-29607 is an authorization bypass vulnerability affecting OpenClaw versions prior to 2026.2.22, specifically in the allow-always wrapper persistence mechanism. The flaw allows attackers to bypass approval checks by persisting wrapper-level allowlist entries rather than validating the intent of the inner executable. This issue, classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), carries a CVSS v3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-03-19.
Remote attackers with high privileges can exploit this vulnerability by tricking users into approving benign wrapped system.run commands. Once approved, attackers can subsequently execute arbitrary different payloads without further approval, achieving remote code execution on gateway and node-host execution flows.
Mitigation is addressed in OpenClaw version 2026.2.22 and later, as detailed in the fixing commit at https://github.com/openclaw/openclaw/commit/24c954d972400f508814532dea0e4dcb38418bb0. Additional guidance appears in the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-6j27-pc5c-m8w8 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-allow-always-wrapper-persistence.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13015
Vulnerability details
OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating inner executable intent. Remote attackers can approve benign wrapped system.run commands…
more
and subsequently execute different payloads without approval, enabling remote code execution on gateway and node-host execution flows.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in wrapper persistence (CWE-78) directly enables remote attackers to achieve arbitrary command/payload execution after tricking approval, mapping to public-facing application exploitation (T1190) and command/scripting interpreter abuse (T1059) for RCE on gateway/node flows.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources like executable intent validation, directly preventing the wrapper-level allowlist persistence bypass.
Validates inputs to system.run commands to neutralize special elements and verify inner executable intent, mitigating the CWE-78 OS command authorization bypass.
Requires timely identification, reporting, and correction of flaws like the allow-always wrapper persistence vulnerability, enabling patching to OpenClaw 2026.2.22 or later.