CVE-2026-100530 — OpenClaw before 2026.8.1 Exec Approval Directory Binding
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers wi…
Published: 2026-09-26 · CVSS: 8.5 · CVSS 4.0
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7