Medium severity5.3NVD Advisory· Published Mar 23, 2026· Updated Jun 17, 2026
CVE-2026-27183
CVE-2026-27183
Description
OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution planner apply different depth-boundary rules, permitting exactly four transparent dispatch wrappers like repeated env invocations before /bin/sh -c to bypass security=allowlist approval gating by misaligning classification with execution planning.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.3.7 | 2026.3.7 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/commit/2fc95a7cfc1eb9306356510b0251b6d51fb1c0b0nvdPatchWEB
- github.com/advisories/GHSA-r6qf-8968-wj9qghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-r6qf-8968-wj9qnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-27183ghsaADVISORY
- vulncheck.com/advisories/openclaw-mar-shell-approval-gating-bypass-via-dispatch-wrapper-depth-mismatchnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.3.7ghsaWEB
News mentions
0No linked articles in our index yet.