CVE-2026-19006: openclaw-cn Auth Bypass Vulnerability

CVE-2026-19006 Overview

CVE-2026-19006 is an incorrect authorization vulnerability [CWE-285] in mf-yang openclaw-cn version 2026.2.5. The flaw resides in the src/agents/bash-tools.exec.ts file within the Ggateway Exec Approval Flow component. Remote attackers with low privileges can bypass the approval workflow to influence execution decisions. Public exploit details are available, though the maintainer has not responded to the disclosure issue at the time of publication.

Critical Impact
Remote authenticated attackers can bypass the Exec Approval Flow in openclaw-cn, resulting in incorrect authorization that impacts confidentiality, integrity, and availability at low levels.

Affected Products

mf-yang openclaw-cn 2026.2.5
Component: Ggateway Exec Approval Flow
File: src/agents/bash-tools.exec.ts

Discovery Timeline

2026-08-06 - CVE-2026-19006 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19006

Vulnerability Analysis

The vulnerability affects the Ggateway Exec Approval Flow used by openclaw-cn to gate shell command execution requested by agents. The approval logic in src/agents/bash-tools.exec.ts does not correctly enforce authorization checks before allowing commands to proceed. As a result, an actor who can reach the gateway and hold low-level credentials can manipulate the flow to bypass intended review steps. Public disclosure includes proof-of-concept material referenced through the project's issue tracker.

Root Cause

The root cause is an incorrect authorization check [CWE-285] within the exec approval logic. The approval routine in bash-tools.exec.ts fails to properly validate that the requesting caller is authorized for the requested action. This missing or flawed enforcement allows the approval decision to be influenced without meeting the intended policy conditions.

Attack Vector

The attack is performed remotely over the network and requires low privileges but no user interaction. An attacker interacts with the gateway's exec approval interface and manipulates the request or state so the flow authorizes an operation that should be denied. This yields limited impact to confidentiality, integrity, and availability of resources reachable through the gateway.

No verified exploit code is included here. Refer to the GitHub Issue #563 and the VulDB CVE Details entry for public technical references.

Detection Methods for CVE-2026-19006

Indicators of Compromise

Unexpected successful command executions through the Ggateway Exec Approval Flow that were not preceded by a valid approval event.
Approval decisions logged for low-privileged principals interacting with bash-tools.exec.ts outside of documented workflows.
Anomalous invocation patterns targeting the agent's bash tools endpoint from previously unseen client identities.

Detection Strategies

Correlate approval request logs with actual command execution logs and alert on executions lacking a matching approval record.
Baseline normal caller identities and command shapes for the exec approval endpoint, then flag deviations such as new users, off-hours activity, or unusual command payloads.
Inspect requests targeting src/agents/bash-tools.exec.ts handlers for patterns that indicate approval bypass attempts.

Monitoring Recommendations

Enable verbose audit logging for the Ggateway Exec Approval Flow, including caller identity, requested command, approval state, and decision.
Forward approval and execution telemetry to a centralized log platform and retain records long enough to support retrospective investigation.
Monitor the upstream repository at openclaw-cn on GitHub for patches, advisories, and updates to issue #563.

How to Mitigate CVE-2026-19006

Immediate Actions Required

Restrict network exposure of the openclaw-cn gateway so only trusted, authenticated clients can reach the exec approval endpoint.
Revoke or tightly scope low-privilege credentials that can currently interact with the Ggateway Exec Approval Flow until a fix is available.
Review recent approval and execution logs for any signs of unauthorized command execution consistent with the disclosed flaw.

Patch Information

At the time of publication, the project has been notified through GitHub Issue #563 but has not released a fix. Track the openclaw-cn repository and the VulDB entry for patch availability. Apply the vendor's fix in openclaw-cn 2026.2.5 as soon as it is published.

Workarounds

Disable or block the Ggateway Exec Approval Flow in environments where it is not required until a patch is released.
Enforce strict allowlists on commands and callers permitted to invoke bash-tools.exec.ts, denying by default.
Require an out-of-band approval step, such as a manual reviewer or ticket confirmation, before any command approved through the flow is executed.

bash

# Configuration example: restrict network access to the openclaw-cn gateway
# Example iptables rule allowing only a trusted management subnet to reach the gateway port
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP