CVE-2026-19006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19006", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-05T20:03:52.232Z", "datePublished": "2026-08-06T06:00:11.430Z", "dateUpdated": "2026-08-06T12:02:14.691Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-06T06:00:11.430Z"}, "title": "mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "mf-yang", "product": "openclaw-cn", "versions": [{"version": "2026.2.5", "status": "affected"}], "cpes": ["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"], "modules": ["Ggateway Exec Approval Flow"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-05T22:09:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "TrumpChen (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/386389", "name": "VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/386389/cti", "name": "VDB-386389 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19006", "name": "CVE-2026-19006 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/862642", "name": "Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mf-yang/openclaw-cn/issues/563", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/mf-yang/openclaw-cn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T11:55:41.918201Z", "id": "CVE-2026-19006", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T12:02:14.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19006", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T11:55:41.918201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T11:57:41.481Z"}}], "cna": {"title": "mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "credits": [{"lang": "en", "type": "reporter", "value": "TrumpChen (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"], "vendor": "mf-yang", "modules": ["Ggateway Exec Approval Flow"], "product": "openclaw-cn", "versions": [{"status": "affected", "version": "2026.2.5"}]}], "timeline": [{"lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-05T22:09:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/386389", "name": "VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/386389/cti", "name": "VDB-386389 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19006", "name": "CVE-2026-19006 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/862642", "name": "Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mf-yang/openclaw-cn/issues/563", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/mf-yang/openclaw-cn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-06T06:00:11.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19006", "state": "PUBLISHED", "dateUpdated": "2026-08-06T12:02:14.691Z", "dateReserved": "2026-08-05T20:03:52.232Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-06T06:00:11.430Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"], "modules": ["Ggateway Exec Approval Flow"], "product": "openclaw-cn", "vendor": "mf-yang", "versions": [{"status": "affected", "version": "2026.2.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en mf-yang openclaw-cn 2026.2.5. Esto afecta una parte desconocida del archivo src/agents/bash-tools.exec.ts del componente Ggateway Exec Approval Flow. La manipulaci\u00f3n resulta en una autorizaci\u00f3n incorrecta. El ataque puede ser realizado desde remoto. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. El proyecto fue informado del problema temprano a trav\u00e9s de un informe de problema pero no ha respondido a\u00fan."}], "id": "CVE-2026-19006", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19006", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T11:55:41.918201Z", "version": "2.0.3"}}]}, "published": "2026-08-06T07:16:29.780", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/mf-yang/openclaw-cn/"}, {"source": "cna@vuldb.com", "url": "https://github.com/mf-yang/openclaw-cn/issues/563"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19006"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/862642"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/386389"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/386389/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-863"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.2.5"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "openclaw-cn", "source": "cna", "vendor": "mf-yang"}, "product": "openclaw-cn", "vendor": "mf-yang"}], "created": "2026-08-06T08:00:03.863539+00:00", "updated": "2026-08-06T08:15:03.935842+00:00", "vendors": ["mf-yang", "mf-yang$PRODUCT$openclaw-cn"]}