Vulnerability Report

CVE-2026-31993

RCE

Title: Allowlist Parsing Mismatch in macOS companion app

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2026-31993.

CWE Category CWE-184
Published Date Mar 19, 2026
Modified Date Mar 19, 2026
Exploit Status Not Found
Score 5.6 CVSS v4.0
Exploit Probability (EPSS)
0.29%

Vulnerability Summary

CVE-2026-31993: OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.

Impacted Vendors

O
openclaw 1

Reference Links

https://github.com/openclaw/openclaw/commit/5da03e622119fa012285cdb590fcf4264c965cb5 https://github.com/openclaw/openclaw/commit/e371da38aab99521c4e076cd3d95fd775e00b784 https://github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch https://www.vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chains
CVSS v4.0
Source Entity [email protected]
Severity MEDIUM
5.6
Attack Vector
NETWORK
Complexity
HIGH
Privileges
N/A
Interaction
ACTIVE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
N/A
RAW VECTOR CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.4
Attack Vector
NETWORK
Complexity
HIGH
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
4.8
Attack Vector
NETWORK
Complexity
HIGH
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-31993 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity HIGH
Privileges N/A
Interaction ACTIVE
CVSS Vector String CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.