CVE-2026-101882
Received Received - Intake

OpenClaw Windows Node Command Injection Flaw

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-01
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-101882
EUVD
EUVD-2026-90255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw windows_node to 2026.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw Windows Node before 2026.7.1 has a flaw where system.execApprovals.set incorrectly allows wildcard-executable rules and dangerous system binaries like mshta, rundll32, and certutil. This lets remote attackers add broad permissions to run arbitrary commands on the Windows host via system.run without proper checks or user confirmation.

Detection Guidance

Check for suspicious wildcard-executable rules in system.execApprovals.set. Look for entries allowing mshta, rundll32, certutil, or other abusable binaries. Review system.run logs for unauthorized command executions.

Impact Analysis

An attacker could exploit this to execute malicious commands on your Windows system, potentially installing malware, stealing data, or taking control of the host. The lack of operator checks or prompts means attacks could happen silently and without user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Organizations may face fines or penalties for failing to protect systems adequately.

Mitigation Strategies

Update OpenClaw Windows Node to version 2026.7.1 or later. Remove any wildcard-executable rules in system.execApprovals.set. Restrict permissions for mshta, rundll32, and certutil binaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart