Openclaw Windows Node Before 2026.7.1 Remote Code Execution Via Environment Override

Back www.vulncheck.com

Openclaw Windows Node Before 2026.7.1 Remote Code Execution Via Environment Override

www.vulncheck.com • October 1, 2026

Share: View original

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node >= 0, = 0, < 2026.7.1

CWE-184 Incomplete List of Disallowed Inputs

GitHub Security Advisory (GHSA-39cf-qcfw-g8pg)

OpenClaw Windows Node v2026.7.1 Release Notes

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Vulnerabilities in OpenClaw Windows Node Disclosed Two vulnerabilities, CVE-2026-101880 and CVE-2026-101884, were disclosed for OpenClaw Windows Node versions prior to 2026.7.1. CVE-2026-101880 allows arbitrary command execution via an authorization bypass, while CVE-2026-101884 enables remote code execution through environment variable manipulation. Both vulnerabilities are rated high severity, with CVSS scores of 8.7 and 7.7 respectively. Attackers with low privileges can exploit these flaws to gain control over affected Windows hosts, potentially leading to data theft or service disruption. No active exploitation has been confirmed, but proof-of-concept indicators exist. Organizations using OpenClaw should prioritize patching and restricting access to vulnerable nodes. The vulnerabilities were published on September 30, 2026. 4 sources 68

Extracted Entities

Attack Types (1)

Remote Code Execution

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Platforms (1)

Vulnerabilities (1)

GHSA-39cf-qcfw-g8pg