CVE-2026-110689: OpenClaw scanner path-skip bypass

CISO Take

CVE-2026-110689 is a protection mechanism failure in the static scanner of OpenClaw ClawScan (up to 0.1.6), where flawed logic in shouldSkipTargetPath lets an attacker craft paths that the scanner wrongly skips, so malicious agent skills can slip through unscanned. The CVSS of 5.3 (medium) understates the practical risk: the flaw requires local access and low privileges, but a public proof-of-concept bypass repository exists and the weakness defeats a control teams may rely on to vet AI agent skills before installation. There is no EPSS score, no CISA KEV listing and no SSVC decision yet, and downstream dependents are unknown, so there is no evidence of active exploitation. Upgrade to ClawScan 0.1.7 (commit 9f6a6fbb) and re-scan any skills that were previously approved by older versions, since a clean result from 0.1.6 or earlier cannot be trusted.

Sources:NVDATLASvuldb.comgithub.com/openclaw/clawscan

What is the risk?

Medium overall. Exploitability is easy (low complexity, low privileges, no user interaction) but local-only, and a public bypass proof-of-concept lowers the skill needed. Impact is confined to the integrity of the scanning control (low confidentiality, integrity and availability), though the downstream consequence is that malicious AI agent skills or tools may be approved as clean. No KEV listing, no EPSS data and no known in-the-wild exploitation. Risk rises in environments that use ClawScan as a gating control for third-party skill intake.

How does the attack unfold?

Craft Evasive Skill

Attacker places malicious content in a path that shouldSkipTargetPath incorrectly excludes from scanning.

AML.T0107

Scanner Bypass

ClawScan 0.1.6 or earlier skips the crafted path and reports the skill as clean.

AML.T0010.005

Skill Approval and Install

The vetted skill is trusted and installed into the AI agent environment.

AML.T0104

Impact

The hidden payload runs with agent privileges, enabling credential theft or manipulated agent behavior.

AML.T0053

Craft Evasive Skill

Attacker places malicious content in a path that shouldSkipTargetPath incorrectly excludes from scanning.

AML.T0107

Scanner Bypass

ClawScan 0.1.6 or earlier skips the crafted path and reports the skill as clean.

AML.T0010.005

Skill Approval and Install

The vetted skill is trusted and installed into the AI agent environment.

AML.T0104

Impact

The hidden payload runs with agent privileges, enabling credential theft or manipulated agent behavior.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Upgrade ClawScan to version 0.1.7 or later (fix commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41). 2) Re-scan every skill or package previously approved with ClawScan 0.1.6 or earlier. 3) Do not rely on ClawScan as the sole control; add manual review, sandboxed execution and least-privilege permissions for agent skills. 4) Review the public bypass repository (nedlir/skills-scanner-bypass) to build detection rules for skills that hide content in skipped paths. 5) Restrict local write access to skill directories and monitor them for unexpected files or directory names that mimic skip patterns.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionAgentPluginFrameworkAML.T0010.005- AI Agent Tool AML.T0104- Publish Poisoned AI Agent Tool AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures address third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110689?

CVE-2026-110689 is a protection mechanism failure in the static scanner of OpenClaw ClawScan (up to 0.1.6), where flawed logic in shouldSkipTargetPath lets an attacker craft paths that the scanner wrongly skips, so malicious agent skills can slip through unscanned. The CVSS of 5.3 (medium) understates the practical risk: the flaw requires local access and low privileges, but a public proof-of-concept bypass repository exists and the weakness defeats a control teams may rely on to vet AI agent skills before installation. There is no EPSS score, no CISA KEV listing and no SSVC decision yet, and downstream dependents are unknown, so there is no evidence of active exploitation. Upgrade to ClawScan 0.1.7 (commit 9f6a6fbb) and re-scan any skills that were previously approved by older versions, since a clean result from 0.1.6 or earlier cannot be trusted.

Is CVE-2026-110689 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-110689, increasing the risk of exploitation.

How to fix CVE-2026-110689?

1) Upgrade ClawScan to version 0.1.7 or later (fix commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41). 2) Re-scan every skill or package previously approved with ClawScan 0.1.6 or earlier. 3) Do not rely on ClawScan as the sole control; add manual review, sandboxed execution and least-privilege permissions for agent skills. 4) Review the public bypass repository (nedlir/skills-scanner-bypass) to build detection rules for skills that hide content in skipped paths. 5) Restrict local write access to skill directories and monitor them for unexpected files or directory names that mimic skip patterns.

What systems are affected by CVE-2026-110689?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent skill and plugin registries, AI supply chain vetting pipelines, CI/CD skill scanning gates.

What is the CVSS score for CVE-2026-110689?

CVE-2026-110689 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent skill and plugin registriesAI supply chain vetting pipelinesCI/CD skill scanning gates

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0104Publish Poisoned AI Agent Tool

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Exploitation Scenario

An adversary publishes or contributes an AI agent skill to a shared repository, placing the malicious payload (a script that steals API keys or an instruction file carrying prompt injection) under a directory or filename pattern that shouldSkipTargetPath wrongly treats as excluded. A security team runs ClawScan 0.1.6 on the skill, receives a clean report and approves it. Once installed in the agent environment, the hidden payload runs with the agent's privileges, exfiltrating credentials or manipulating agent behavior.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-693Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.