CVE-2026-41392: OpenClaw: Shell init-file options could satisfy exec allowlist script matching
(updated )
Before OpenClaw 2026.3.31, exec allowlist matching could treat shell init-file wrapper invocations as if the approved script itself were being executed. Shell options such as --rcfile, --init-file, and --startup-file could therefore inherit allowlist trust from a matched script path even though the shell loaded attacker-chosen initialization first.
References
- github.com/advisories/GHSA-wpc6-37g7-8q4w
- github.com/openclaw/openclaw/commit/0c8375424620e12777ef24c162eedc7e9fcfd7e3
- github.com/openclaw/openclaw/security/advisories/GHSA-wpc6-37g7-8q4w
- nvd.nist.gov/vuln/detail/CVE-2026-41392
- www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-shell-init-file-options
Code Behaviors & Features
Detect and mitigate CVE-2026-41392 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →