CVE-2026-100584

OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory. If lower-trust content can place an executable with an approved basename into an agent-writable workspace and steer an approved PowerShell command that uses a bare executable name, OpenClaw may run the workspace file instead of the allowlisted path, executing arbitrary code with the privileges of the Gateway or node-host user. The issue does not require replacement of the approved executable itself. Version 2026.7.1 contains a fix; as a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces.

• CWE-426

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rgjw-6v73-php6
• https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-allowlist-bypass-via-workspace-shadows

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100579OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectl…7.6
• CVE-2026-10058ITS Intelligent SCADA System developed by ITP Technology has…4.8
• CVE-2026-100580OpenClaw (npm package 'openclaw') before 2026.7.1 improperly…8.8
• CVE-2026-100581OpenClaw for iOS before 2026.8.11 stores Gateway credentials…5.5
• CVE-2026-100582OpenClaw channel plugins (@openclaw/msteams, @openclaw/feish…6.5
• CVE-2026-100583OpenClaw Discord versions before 2026.7.1 contain an authori…4.3
• CVE-2026-100585OpenClaw (npm package `openclaw`) before 2026.7.1 fails to e…8
• CVE-2026-100586OpenClaw Codex before 2026.7.1 fails to properly enforce own…8.8
• CVE-2026-100587OpenClaw versions before 2026.7.1 fail to properly validate …8.8
• CVE-2026-100588OpenClaw (npm package 'openclaw') before 2026.7.1 does not e…8.3
• CVE-2026-100589OpenClaw versions before 2026.7.1 contain a sandbox bypass v…8.3
• CVE-2026-10059A flaw was found in the Multicluster Engine for Kubernetes C…9.1