CVE-2026-101880
Received Received - Intake

Incorrect Authorization in OpenClaw Windows Node Allows Command Execution

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-01
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-101880
EUVD
EUVD-2026-90253

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in OpenClaw Windows Node before version 2026.7.1. The system.run exec-approval policy fails to properly split commands containing pipe operators (|) or extract command substitutions like $(...). This allows attackers to bypass approval rules by embedding denied commands behind allowed prefixes using these operators, enabling arbitrary command execution on Windows hosts.

Detection Guidance

To detect this vulnerability, inspect OpenClaw Windows Node versions before 2026.7.1. Check for improper command parsing in exec-approval policies by reviewing logs for commands using pipe operators or command substitutions like $(...) or backticks. Use commands such as 'systeminfo | findstr /B /C:"OpenClaw"' to identify affected software versions.

Impact Analysis

This vulnerability allows unauthorized command execution on Windows hosts running vulnerable OpenClaw Windows Node versions. Attackers or compromised agents could run arbitrary commands, potentially leading to data theft, system compromise, or disruption of services. The high CVSS score (8.7-8.8) indicates significant impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. Failure to prevent such breaches may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update OpenClaw Windows Node to version 2026.7.1 or later. Ensure the ExecShellWrapperParser properly splits commands on pipe operators and extracts command substitutions for policy evaluation. Review and tighten exec-approval deny rules to cover all command structures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart