VULNERABILITY INTELLIGENCE

CVE-2026-42423

CVSS score7.5 HIGH
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-04-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.

Weakness classification

  • disclosure@vulncheck.com: CWE-636

Primary references