CVE-2026-43530 - Vulnerability Analysis

Overview

OpenClaw 2026.2.23 < 2026.4.12 contains a broken authentication caused by weakened exec approval binding in busybox and toybox applet execution, letting attackers obscure applet execution and bypass exec approval, exploit requires crafted opaque multi-call binaries.

Severity & Score

Impact

Attackers can bypass exec approval mechanisms, obscuring applet execution and weakening risk classification, potentially leading to unauthorized command execution.

Mitigation

Upgrade to version 2026.4.12 or later.

References

• https://github.com/openclaw/openclaw/commit/666f48d9b882a8a1415ca53f9567c72499d850c9
• https://github.com/openclaw/openclaw/security/advisories/GHSA-2cq5-mf3v-mx44
• https://www.vulncheck.com/advisories/openclaw-weakened-exec-approval-binding-via-busybox-and-toybox-applet-execution

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner