CyberRota Analysis
AI-GeneratedThe ClickClack allowFrom feature in OpenClaw versions prior to 2026.5.26 is vulnerable to an incorrect authorization issue, allowing lower-trust callers to execute unauthorized actions, including running commands not on the allowlist. This could lead to potential exploitation by malicious actors if the feature is enabled and accessible. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, including running non-allowlisted commands.
Related CVEs
Other vulnerabilities affecting the same vendor(s)