CVE-2026-25593

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25593", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-03T01:02:46.716Z", "datePublished": "2026-02-06T20:56:02.824Z", "dateUpdated": "2026-02-09T15:27:48.829Z"}, "containers": {"cna": {"title": "OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg"}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"version": "< 2026.1.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T20:56:02.824Z"}, "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20."}], "source": {"advisory": "GHSA-g55j-c2v4-pjcg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:20:45.246273Z", "id": "CVE-2026-25593", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:27:48.829Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25593", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-09T15:20:45.246273Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:20:46.234Z"}}], "cna": {"title": "OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply", "source": {"advisory": "GHSA-g55j-c2v4-pjcg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.20"}]}], "references": [{"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg", "name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T20:56:02.824Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25593", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:27:48.829Z", "dateReserved": "2026-02-03T01:02:46.716Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T20:56:02.824Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openclaw", "vendor": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.20"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E5B8DFA8-AEDD-4BC1-A7FD-CE3673D8EDDE", "versionEndExcluding": "2026.1.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20."}, {"lang": "es", "value": "OpenClaw es un asistente personal de IA. Antes de la versi\u00f3n 2026.1.20, un cliente local no autenticado pod\u00eda usar la API WebSocket de Gateway para escribir la configuraci\u00f3n a trav\u00e9s de config.apply y establecer valores inseguros de cliPath que luego se usaban para el descubrimiento de comandos, lo que permit\u00eda la inyecci\u00f3n de comandos como el usuario de gateway. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2026.1.20."}], "id": "CVE-2026-25593", "lastModified": "2026-06-17T10:24:55.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25593", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:20:45.246273Z", "version": "2.0.3"}}]}, "published": "2026-02-06T21:16:17.790", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:25:59.315801+00:00", "value": {"mitigation_remediation": ["Update to OpenClaw version 2026.1.20 or later, which removes the vulnerability.", "If an upgrade is not immediately possible, block or disable access to the Gateway WebSocket API on the host or restrict it to trusted clients using firewall rules or network segmentation.", "Verify that any cliPath configuration values are either removed or set to safe, predetermined paths, and if possible, apply input validation to reject paths that could lead to command execution."], "summary": {"action": "Apply Patch", "impact": "Local Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the OpenClaw personal AI assistant, versions earlier than 2026.1.20. The recommendation applies to all deployments of OpenClaw prior to that release.", "description_and_impact": "An unauthenticated local client can connect to the Gateway WebSocket API and invoke config.apply to write configuration entries. By supplying an unsafe cliPath value, the application stores the string to be used for command discovery during subsequent operations. This allows a local attacker to inject operating\u2011system commands that are executed on the gateway user\u2019s behalf, leading to arbitrary code execution on the host. The weakness is a combination of missing authentication and OS command injection.", "risk_and_exploitability": "The CVSS score of 8.4 reflects significant impact. While the exploit probability (EPSS) is very low (<1%) and the vulnerability is not listed in the CISA KEV catalog, the local attack requirement means that an attacker must already have local or network access to the device. Nevertheless, the absence of authentication on the WebSocket endpoint makes exploitation straightforward for any process running on or able to reach the gateway. Timely patching is therefore essential."}}}}, "created": "2026-02-09T10:49:52.862253+00:00", "updated": "2026-04-17T22:30:29.596155+00:00", "vendors": ["openclaw", "openclaw$PRODUCT$openclaw"]}