Incorrect authorization in OpenClaw - #VU149037
Published: September 12, 2026
Vulnerability identifier: #VU149037
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access or modify unreviewed files or repositories.
The vulnerability exists due to incorrect authorization in reusable exec approvals when reusing an approved command in a different working directory. A remote user can obtain an allow-always approval for a command and reuse it in a directory with materially different read or write effects to access or modify unreviewed files or repositories.
User interaction is required for the operator\'s initial approval.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.8.1