CVE-2026-41392: OpenClaw Auth Bypass Vulnerability

CVE-2026-41392 Overview

CVE-2026-41392 is an authorization bypass vulnerability in OpenClaw before version 2026.3.31 that allows attackers to circumvent exec allowlist protections through shell initialization file wrapper invocations. By exploiting shell options such as --rcfile, --init-file, and --startup-file, attackers can load attacker-controlled initialization files while inheriting the trust granted by the exec allowlist matching system.

This vulnerability stems from CWE-184 (Incomplete List of Disallowed Inputs), where the allowlist matching logic fails to properly validate shell initialization file arguments, creating a path for unauthorized code execution within trusted contexts.

Critical Impact
Attackers can bypass exec allowlist security controls by leveraging shell initialization file options to execute arbitrary code while inheriting trusted process permissions.

Affected Products

OpenClaw versions prior to 2026.3.31

Discovery Timeline

2026-04-28 - CVE CVE-2026-41392 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41392

Vulnerability Analysis

This vulnerability exists in OpenClaw's exec approvals allowlist mechanism, specifically within the shell wrapper option handling logic. The security control is designed to validate and approve executable invocations based on a predefined allowlist. However, the implementation failed to account for shell initialization file options that allow attackers to specify custom script paths to be executed during shell startup.

The core issue lies in how shell wrapper options were categorized. Options like -c, --command, -o, -O, and +O were correctly identified as options that take values, but the implementation included --rcfile, --init-file, and --startup-file in the same category without recognizing their security implications. These initialization file options fundamentally differ from other options because they cause the shell to load and execute external scripts during startup, effectively allowing an attacker to inherit the trust context of an approved executable.

Root Cause

The root cause is CWE-184 (Incomplete List of Disallowed Inputs). The exec allowlist validation logic in src/infra/exec-approvals-allowlist.ts treated shell initialization file options (--rcfile, --init-file, --startup-file) as standard value-accepting options rather than recognizing them as potential security bypass vectors. This incomplete threat model allowed attackers to specify malicious initialization files that would execute within the trusted context of an allowlisted shell invocation.

Attack Vector

The attack requires local access and user interaction. An attacker with low privileges can craft a shell command that passes allowlist validation by using an approved shell executable but specifying a malicious initialization file through the vulnerable options. When the shell starts, it loads and executes the attacker-controlled initialization script while operating within the security context established by the allowlist approval.

For example, an attacker could construct a command using --init-file=/path/to/malicious/script alongside an otherwise approved shell invocation, causing the malicious script to execute with inherited trust permissions.

The following patch from the GitHub commit shows how OpenClaw addressed this vulnerability by separating shell initialization file options into a distinct disqualifying category:

typescript

   return hasSegmentExecutableMatch(segment, isShellWrapperExecutable);
 }
 
-const SHELL_WRAPPER_OPTIONS_WITH_VALUE = new Set([
-  "-c",
-  "--command",
-  "-o",
-  "-O",
-  "+O",
+const SHELL_WRAPPER_OPTIONS_WITH_VALUE = new Set(["-c", "--command", "-o", "-O", "+O"]);
+
+const SHELL_WRAPPER_DISQUALIFYING_SCRIPT_OPTIONS = [
   "--rcfile",
   "--init-file",
   "--startup-file",
-]);
+] as const;
+
+function hasDisqualifyingShellWrapperScriptOption(token: string): boolean {
+  return SHELL_WRAPPER_DISQUALIFYING_SCRIPT_OPTIONS.some(
+    (option) => token === option || token.startsWith(`${option}=`),
+  );
+}
 
 function resolveShellWrapperScriptCandidatePath(params: {
   segment: ExecCommandSegment;

Source: GitHub Commit Changes

Detection Methods for CVE-2026-41392

Indicators of Compromise

Shell processes started with --rcfile, --init-file, or --startup-file arguments pointing to non-standard or suspicious file paths
Unexpected initialization scripts being loaded from user-writable directories
Process execution chains where approved shell invocations spawn unexpected child processes

Detection Strategies

Monitor process command lines for shell executions containing --rcfile, --init-file, or --startup-file options with untrusted file paths
Implement file integrity monitoring on standard shell initialization file locations
Analyze shell process parent-child relationships for anomalous execution patterns

Monitoring Recommendations

Enable detailed command-line logging for shell processes (bash, sh, zsh) to capture initialization file arguments
Alert on shell invocations where initialization file paths do not match expected system or user profile locations
Deploy endpoint detection rules targeting shell wrapper bypass patterns in exec approval workflows

How to Mitigate CVE-2026-41392

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Review recent shell execution logs for potential exploitation attempts using initialization file options
Audit existing exec allowlist configurations to identify potentially affected approval patterns

Patch Information

OpenClaw has released version 2026.3.31 which addresses this vulnerability by implementing a dedicated check for disqualifying shell wrapper script options. The fix separates --rcfile, --init-file, and --startup-file from the standard options list and creates a new validation function hasDisqualifyingShellWrapperScriptOption() that rejects any shell invocation attempting to use these options.

For detailed patch information, see the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

If immediate patching is not possible, implement additional monitoring controls around shell executions with initialization file options
Consider restricting shell initialization file options at the policy level until the patch can be applied
Review and restrict user permissions that could enable exploitation of this bypass technique

bash

# Example: Monitor for suspicious shell init-file invocations
# Add to audit rules or SIEM detection
grep -E '\-\-(rcfile|init-file|startup-file)' /var/log/audit/audit.log