CVE-2026-91836
Received Received - Intake

Incomplete Comparison in OpenClaw ClawScan Static Scanner

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91836
EUVD
EUVD-2026-78767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw clawscan to 0.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1023 The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in OpenClaw ClawScan up to version 0.1.6, specifically in the Static Scanner component. It involves an incomplete comparison in the file internal/runner/static_scanner.go due to missing factors. This flaw allows an attacker to exploit it locally on the host system. The issue has been publicly disclosed and a patch is available in version 0.1.7.

Detection Guidance

To detect this vulnerability, check if your system is running OpenClaw ClawScan versions up to 0.1.6. Verify the version with: clawscan --version. If the version is 0.1.6 or lower, the system is vulnerable. Upgrade to version 0.1.7 or later immediately.

Impact Analysis

The vulnerability may allow an attacker with local access to manipulate the Static Scanner component, potentially leading to incorrect scanning results or unauthorized actions. However, the impact is limited as it requires local access and has a low CVSS score, indicating minimal severity.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a local file scanning bypass in OpenClaw ClawScan. The flaw allows malicious executable code to evade detection by skipping .git files, which could lead to undetected security risks in scanned environments. However, no evidence suggests direct impacts on data protection or privacy compliance standards.

Mitigation Strategies

Upgrade OpenClaw ClawScan to version 0.1.7 or later. The patch name is 9f6a6fbb9f1137345566d0ab44c73893dfe112fa.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart