ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0433

ACVE-2026-0433

OpenClaw below 2026.8.1, running with a standing execution approval, could reuse an approved command in a different working directory against files the operator had not reviewed.

Exposure

Harness
OpenClaw below 2026.8.1 — confirmed, github.com
Model
any — unconfirmed
Goal
Any task that uses an approved exec command (goal not stated by the source) — unconfirmed
Tools and settings
Reusable exec approvals and the working directory in which the command runs — confirmed, github.com
Approval
An allow-always approval can outlive the working directory that was reviewed — confirmed, github.com
Input controlled by
operator
What the agent does
The agent reuses an approved command in a different working directory.
Harm
harmful-action
Reach
Files and repositories in the later working directory — confirmed, github.com (project files, private repositories)

Reproducibility: partial (trigger not published)

Severity
HIGH
Status
Unverified
Kind
Code
Source date
2026-09-11
Modified
2026-09-25
Aliases
GHSA-3mq7-q27j-mq7q
Affected
  • npm: openclaw — < 2026.8.1
Harness/product
openclaw
Classes
unsafe-permission-mode; over-privileged-combination; CWE-863
Taxonomy
ASI: ASI03; ASI: ASI02
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Identifier GHSA-3mq7-q27j-mq7qConfirmedapi.github.com2026-09-24
Upgrade target 2026.8.1Confirmedregistry.npmjs.org2026-09-24
Latest affected version 2026.7.35 (below fixed 2026.8.1) is still installable from npmConfirmedregistry.npmjs.org2026-09-24

In the wild

demonstrated · vendor

Description

What

The OpenClaw advisory says reusable exec approvals matched command arguments without binding the working directory. An approval obtained for one directory could therefore apply later in another directory with materially different read or write effects.

Detection

Recorded from the OpenClaw security advisory. Not recreated in a lab.

Fix

Upgrade OpenClaw to 2026.8.1 or later and review standing approvals.

Fix

Upgrade OpenClaw to 2026.8.1 or later and bind approvals to the reviewed directory.

  • Upgrade npm:openclaw to 2026.8.1. First stable patched version in the advisory. Owner: operator

References

ADVISORY

Report a problemJSON