CVE-2026-100584— OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw 是一个通过 npm 分发的代理运行时（agent runtime）。在版本 >= 2026.2.26 且 < 2026.7.1 中，当在允许执行列表（exec allowlist）模式下运行的 Windows 主机上执行 PowerShell 命令分析时，系统可能会批准从系统 PATH 路径解析出的某个可执行文件，但实际上却执行了位于工作区（workspace）目录中同名且可执行的文件。 如果低信任度内容能够将一个具有已批准基本名称（basename）的可执行文件放置到代理可写的工作区目录中，并诱
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100584
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory. If lower-trust content can place an executable with an approved basename into an agent-writable workspace and steer an approved PowerShell command that uses a bare executable name, OpenClaw may run the workspace file instead of the allowlisted path, executing arbitrary code with the privileges of the Gateway or node-host user. The issue does not require replacement of the approved executable itself. Version 2026.7.1 contains a fix; as a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100584
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100584
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100584 (1)
Other References for CVE-2026-100584 (1)
Same Patch Batch · OpenClaw · 2026-09-26 · 79 CVEs total
| CVE-2026-100587 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via Codex Install |
| CVE-2026-100544 | 8.8 HIGH | openclaw voice-call before 2026.8.1 Authorization Bypass |
| CVE-2026-100599 | 8.8 HIGH | OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome |
| CVE-2026-100580 | 8.8 HIGH | OpenClaw before 2026.7.1 Remote Code Execution via cron tool |
| CVE-2026-100575 | 8.8 HIGH | OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM |
| CVE-2026-100596 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration |
| CVE-2026-100586 | 8.8 HIGH | OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind |
| CVE-2026-100552 | 8.8 HIGH | OpenClaw before 2026.8.1 Policy Bypass via Native Tools |
| CVE-2026-100551 | 8.3 HIGH | OpenClaw iOS Control UI TLS Pin Enforcement Bypass |
| CVE-2026-100589 | 8.3 HIGH | OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node |
| CVE-2026-100588 | 8.3 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via node.invoke |
| CVE-2026-100557 | 8.3 HIGH | OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch |
| CVE-2026-100568 | 8.3 HIGH | OpenClaw before 2026.8.1 Unauthorized Command Job Access |
| CVE-2026-100567 | 8.2 HIGH | OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname |
| CVE-2026-100532 | 8.1 HIGH | openclaw WhatsApp before 2026.8.1 Authentication Bypass |
| CVE-2026-100559 | 8.0 HIGH | OpenClaw before 2026.8.1 Command Injection via Escaped Newlines |
| CVE-2026-100561 | 8.0 HIGH | OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper |
| CVE-2026-100585 | 8.0 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel |
| CVE-2026-100570 | 7.8 HIGH | OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS |
| CVE-2026-100597 | 7.8 HIGH | OpenClaw before 2026.7.1 Path Traversal via Filesystem Race |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race -
CVE-2026-100596
OpenClaw before 2026.7.1 Authorization Bypass via MCP Config -
CVE-2026-100594
OpenClaw before 2026.7.1 Authorization Bypass via trajectory
Same vendor: OpenClaw
-
CVE-2026-100603
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Repor -
CVE-2026-100604
ClawHub Authentication Bypass via Former Publisher Skill Con -
CVE-2026-100602
ClawHub Changelog Preview Information Disclosure via Authori -
CVE-2026-100600
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API -
CVE-2026-100601
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Same weakness: CWE-426
-
CVE-2026-87723
Untrusted Search Path (PATH Hijacking) in fuse-archive -
CVE-2026-100310
GNU libextractor before 1.16 Privilege Escalation via LIBEXT -
CVE-2026-68492
Plesk 18.0.34-18.0.81 路径遍历漏洞 -
CVE-2026-92587
n8n before 1.123.76 Sandbox Escape via Git Relative URL -
CVE-2026-0307
GlobalProtect App: Local Privilege Escalation Vulnerabilitie
V. Comments for CVE-2026-100584
No comments yet