Medium severity4.8NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-31993

Description

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.22	2026.2.22

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.22
- (no CPE)range: 0
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.22

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/5da03e622119fa012285cdb590fcf4264c965cb5nvdPatchWEB
github.com/openclaw/openclaw/commit/e371da38aab99521c4e076cd3d95fd775e00b784nvdPatchWEB
github.com/advisories/GHSA-5f9p-f3w2-fwchghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwchnvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-31993ghsaADVISORY
www.vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chainsnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000