CVE-2026-100560

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-100560

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100560.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-100560

Aliases

GHSA-74gc-hg2m-79p9

Downstream

MINI-48v6-4vc9-hrpj

Published

2026-09-26T02:18:53Z

Modified

2026-10-21T02:54:25Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

Details

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100560.json"
}

References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type

GIT

Repo

https://github.com/openclaw/openclaw

Events

Introduced

Fixed

ea806575e6450e4d1efdfc72c19f04be982a1b9b

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026.8.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026.8.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other

release-publish/08987d8f409b-20260717

release-publish/0e9db600595-20260717

release-publish/0e9db6005954-20260717

release-publish/0f7fbfa0039f-20260715

release-publish/10a390ed7fa8-20260802

release-publish/17a1225314cd-1787924262

release-publish/1c80cf86cfd0-1787823217

release-publish/1d2777548d01-20260715

release-publish/2133a924eef0-1787945469

release-publish/21b41efc7bb8-1787818100

release-publish/23d2f664fb75-20260715

release-publish/38fd9ad6e417-1787824804

release-publish/404719374e60-1787933925

release-publish/4074a8b44d89-1787849600

release-publish/45ed68e6ea62-1787220256

release-publish/468054f93c43-1787921799

release-publish/491769bded58-1787929537

release-publish/5090935817e3-1787842724

release-publish/54f70c5d8c04-20260715

release-publish/556a2ee276f0-20260718

release-publish/57fabb2c9c35-1786621048

release-publish/5cb2eee257bc-1787929587

release-publish/5cb2eee257bc-1787929714

release-publish/5dca33a8fb67-20260802

release-publish/62c77b0fb51c-1787927225

release-publish/6ddb9f049fb3-1787938179

release-publish/716f996be8db-1786550775

release-publish/728084497329-20260801

release-publish/73d04395defe-20260717

release-publish/7c9794b5c65c-20260801

release-publish/8371831eba5e-1786610071

release-publish/8858944a81c5-20260717

release-publish/8afa8f339eb6-1787798436

release-publish/9b80f9a8b1df-20260717

release-publish/9bc3c2955500-20260802

release-publish/a33c8a5c0ec6-1787896022

release-publish/a84a915b67bd-1787933964

release-publish/a9ac13b2efd7-20260717

release-publish/abd63c06c2f5-1786646045

release-publish/b3986403ddb9-1787938102

release-publish/bb1a7e506927-20260715

release-publish/bccb649077f0-1787900300

release-publish/c28c279afa37-1787225611

release-publish/c3927271fad7-20260715

release-publish/c96e81375014-1787462685

release-publish/ced50f88e928-20260717

release-publish/d5412d73acfb-1787906286

release-publish/d8b3e1c093f2-20260715

release-publish/d8dd59bf8f60-20260717

release-publish/deffca656500-20260801

release-publish/dfa246e6fd16-20260715

release-publish/e11c566824b1-1787940135

release-publish/eb8c22ed13f9-20260801

release-publish/ebc70fa1b3f6-1787634336

release-publish/f4987deb94b8-1786361493

release-publish/f4f5bb15d46a-20260715

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v1.*

v1.0.4

v1.1.0

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v2.*

v2.0.0-beta1

v2.0.0-beta2

v2.0.0-beta3

v2.0.0-beta4

v2.0.0-beta5

v2026.*

v2026.1.10

v2026.1.11

v2026.1.11-1

v2026.1.11-2

v2026.1.11-3

v2026.1.12

v2026.1.12-2

v2026.1.13

v2026.1.14-1

v2026.1.15

v2026.1.16-2

v2026.1.20

v2026.1.21

v2026.1.22

v2026.1.23

v2026.1.24

v2026.1.24-1

v2026.1.29

v2026.1.30

v2026.1.5

v2026.1.5-1

v2026.1.5-2

v2026.1.5-3

v2026.1.8

v2026.1.9

v2026.2.1

v2026.2.12

v2026.2.13

v2026.2.14

v2026.2.15-beta.1

v2026.2.17

v2026.2.19

v2026.2.19-beta.1

v2026.2.2

v2026.2.21

v2026.2.21-beta.1

v2026.2.22

v2026.2.22-beta.1

v2026.2.23

v2026.2.23-beta.1

v2026.2.24

v2026.2.24-beta.1

v2026.2.25

v2026.2.25-beta.1

v2026.2.26

v2026.2.26-beta.1

v2026.2.3

v2026.2.6

v2026.2.6-1

v2026.2.6-2

v2026.2.6-3

v2026.2.9

v2026.3.1

v2026.3.11

v2026.3.11-beta.1

v2026.3.12

v2026.3.13

v2026.3.13-1

v2026.3.2

v2026.3.2-beta.1

v2026.3.22

v2026.3.22-beta.1

v2026.3.23

v2026.3.23-2

v2026.3.23-beta.1

v2026.3.24

v2026.3.24-beta.1

v2026.3.24-beta.2

v2026.3.28

v2026.3.28-beta.1

v2026.3.31

v2026.3.31-beta.1

v2026.3.7

v2026.3.7-beta.1

v2026.3.8

v2026.3.8-beta.1

v2026.4.1

v2026.4.1-beta.1

v2026.4.10

v2026.4.11

v2026.4.11-beta.1

v2026.4.12

v2026.4.12-beta.1

v2026.4.14

v2026.4.14-beta.1

v2026.4.15

v2026.4.15-beta.1

v2026.4.15-beta.2

v2026.4.19-beta.1

v2026.4.19-beta.2

v2026.4.2

v2026.4.5

v2026.4.7

v2026.4.7-1

v2026.4.8

v2026.4.9

v2026.4.9-beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100560.json"