CVE-2026-35666
OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inner commands.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.37%
- CWE
- CWE-706
- Published
- 2026-04-10
- Last modified
- 2026-06-23
Affected products
- OpenClaw OpenClaw
- OpenClaw OpenClaw
Weakness type
Related vulnerabilities
- CVE-2026-87618 — Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36...
- CVE-2026-87562 — Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-87613 — Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-87547 — Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-81383 — Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-79254 — Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79273 — Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79103 — Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote...