7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53866

CVE-2026-53866: OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53866

CVE-2026-53866:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.5.10-beta.1	2026.5.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches reveals two main vulnerabilities within the exec tool of OpenClaw, both leading to a bypass of security controls.

The first vulnerability, addressed in commit 235ad7ec956513c632c20eedd68bfbedc8cc3ea8, is in the createExecTool function in src/agents/bash-tools.exec.ts. This function was incorrectly calculating the security level for the exec tool by using minSecurity to combine the operator-configured security level with a security parameter that could be supplied by the model. This allowed a malicious or compromised model to request a lower security level (e.g., allowlist instead of full) and bypass the intended security policy, leading to unauthorized command execution. The fix makes the configured security level authoritative, ignoring the model-supplied parameter.

The second vulnerability, addressed in commit a8a34c92f397b55f81ca09cbacc3bc2469a2d427, is a path traversal-like issue in the validateScriptFileForShellBleed function, also in src/agents/bash-tools.exec.ts. This function, responsible for pre-flight checks on scripts to be executed, did not properly handle paths containing a tilde (~). The naive normalization of such paths could be exploited to make the application read and execute a script from outside the intended workspace directory. The patch introduces a dedicated function, readLiteralTildePreflightScript, to securely handle these paths by resolving their real path and ensuring they are within the workspace root before reading them.

Both of these functions are critical to the security of the exec tool. During an exploit, createExecTool would have been called to create a misconfigured tool, and then the tool's execute method would be called, which in turn calls validateScriptFileForShellBleed for script execution, triggering the vulnerabilities. Therefore, these two functions are the root cause and would be indicators of the vulnerability being present or exploited.

Vulnerable functions

createExecTool

src/agents/bash-tools.exec.ts

This function was vulnerable because it allowed a model-supplied `security` parameter to weaken the configured security policy of the `exec` tool. It used `minSecurity` to combine the configured security with the requested security, allowing a less secure mode to be used if requested by the tool's input. This could lead to an allowlist bypass and unauthorized command execution.

validateScriptFileForShellBleed

src/agents/bash-tools.exec.ts

This function was vulnerable to a path traversal-like issue. It did not correctly handle script paths containing a tilde (`~`). An attacker could craft a path that, after naive normalization, could point to a file outside the intended workspace, leading to the execution of an unauthorized script. The patch introduces `readLiteralTildePreflightScript` to securely handle these paths.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.