CVE-2026-41392: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41392 is an exec allowlist bypass vulnerability in OpenClaw (npm package) affecting all versions before 2026.3.31. The flaw allows low-privileged local attackers to inherit allowlist trust by invoking shell init-file wrapper options (--rcfile, --init-file, --startup-file), causing OpenClaw to treat the shell invocation as if an approved script were being executed directly. It was published on April 28, 2026, and assigned a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs): OpenClaw's exec allowlist matching logic did not account for shell options that load external initialization files, allowing those options to be treated as part of an approved command shape (GitHub Advisory). Specifically, when exec allowlist or allow-always behavior was enabled, an attacker could craft a shell-wrapper command such as bash --rcfile scripts/evilrc scripts/save_crystal.sh, where scripts/save_crystal.sh matched an allowlisted path but the shell actually loaded the attacker-controlled evilrc initialization file first (GitHub Commit). The fix removes --rcfile, --init-file, and --startup-file from the set of options treated as value-carrying shell wrapper options and instead marks them as disqualifying, causing any command containing them to fail allowlist matching (GitHub Commit). Exploitation requires local access, low privileges, user interaction, and that exec allowlist or allow-always mode is active.

Successful exploitation allows an attacker to load and execute attacker-chosen shell initialization files under the trust context of an allowlisted script, effectively bypassing the exec allowlist protection mechanism. This can result in high-impact compromise of confidentiality, integrity, and availability on the affected system, as arbitrary code from the malicious init file executes with the privileges of the shell process (GitHub Advisory, Feedly). The advisory notes this is a narrower allowlist bypass rather than generic arbitrary command execution from an untrusted boundary, and it only applies when exec allowlist or allow-always behavior is enabled (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.02%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, user interaction, and a specific configuration (exec allowlist or allow-always mode enabled), which significantly limits the attack surface.

1. Identify target configuration: Confirm that the target system runs OpenClaw (npm) version prior to 2026.3.31 with exec allowlist or allow-always mode enabled.
2. Enumerate allowlisted scripts: Determine which script paths are approved by the exec allowlist (e.g., scripts/save_crystal.sh).
3. Prepare malicious init file: Create an attacker-controlled shell initialization file (e.g., scripts/evilrc) containing arbitrary commands to execute.
4. Craft shell-wrapper command: Construct a command that references both the allowlisted script and the malicious init file using a shell init-file option, such as: bash --rcfile scripts/evilrc scripts/save_crystal.sh or bash --init-file=scripts/evilrc scripts/save_crystal.sh.
5. Trigger execution: Cause the target user or process to execute the crafted command (user interaction required). OpenClaw's allowlist matching sees the approved script path and grants trust, while the shell loads the attacker's init file first.
6. Achieve code execution: The malicious initialization file executes arbitrary commands under the shell's privilege context, bypassing the exec allowlist (GitHub Advisory, GitHub Commit).

• Process: Shell processes (e.g., bash, sh) spawned with --rcfile, --init-file, or --startup-file arguments pointing to unexpected or attacker-controlled file paths alongside an allowlisted script path.
• File System: Unexpected or newly created shell initialization files (e.g., files named evilrc, .bashrc-like files in non-standard directories, or scripts in world-writable locations) referenced in shell invocations.
• Logs: Application or audit logs showing shell invocations with init-file options where the init file path differs from the script path being allowlist-matched; process audit logs (e.g., auditd) recording execve calls with --rcfile or --init-file arguments.
• Network: Unexpected outbound connections from shell processes that were invoked via OpenClaw's exec allowlist mechanism, potentially indicating post-exploitation activity.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which rejects shell init-file options (--rcfile, --init-file, --startup-file) during allowlist matching (GitHub Advisory, GitHub Commit). The current published npm release 2026.4.1 (April 1, 2026) also contains the fix. As interim mitigations: restrict local access to systems running vulnerable OpenClaw versions, monitor for shell invocations using init-file options, and limit user privileges to reduce attack surface (Feedly).

The vulnerability was reported by researcher cyjhhh and published as a GitHub Security Advisory (GHSA-wpc6-37g7-8q4w) by maintainer steipete on April 2, 2026, with the fix credited to jacobtomlinson (GitHub Advisory). VulnCheck independently catalogued the advisory. No significant broader media coverage or notable community discussion has been identified beyond the standard vulnerability database entries.