CVE-2026-19006: auth bypass — MEDIUM

CISO Take

openclaw-cn's Exec Approval Flow — the gate meant to require human or policy sign-off before its AI agent runs shell commands — can be bypassed by a low-privileged remote user, letting src/agents/bash-tools.exec.ts execute commands without the intended authorization check. This matters because an approval flow is the last safety control on any agent wired to a real shell, and a bypass here effectively restores unrestricted command execution to anyone who can reach the interface with low privileges and no user interaction (CVSS 6.3, AV:N/PR:L/UI:N). VulDB indicates an exploit has already been made public, and the maintainer was notified early via a GitHub issue but has not responded, so there is no vendor patch timeline to rely on. EPSS is low (0.00209) and CISA's SSVC decision is TRACK_STAR — signaling low priority for mass, opportunistic exploitation — but that doesn't help a targeted attacker who already has a working bypass against a live deployment. Until a fix lands, disable or manually gate the bash-tools.exec.ts execution path, restrict network access to the approval gateway, and alert on any agent-triggered shell command that lacks a matching approval record.

Sources: NVD EPSS CISA SSVC ATLAS VulDB

What is the risk?

CVSS 6.3 (medium) undersells the structural risk: the flaw sits directly in the control designed to gate arbitrary command execution by an AI agent, so a successful bypass converts a low-privileged, no-interaction remote request into shell command execution. EPSS (0.00209) and the absence from CISA KEV, combined with CISA's SSVC TRACK_STAR decision, indicate low likelihood of mass/automated exploitation. However, a public exploit reportedly exists (per VulDB) and the maintainer has gone unresponsive to an early issue report, so there is elevated risk for any organization specifically running openclaw-cn with real shell access wired to the agent — this is a targeted-risk profile, not a mass-exploitation one.

How does the attack unfold?

Initial access

A remote, low-privileged actor sends a request to the openclaw-cn gateway that exposes the bash tool's approval flow, requiring no user interaction.

Authorization bypass

The attacker exploits the incorrect-authorization logic in src/agents/bash-tools.exec.ts to have the request treated as pre-approved, skipping the intended human/policy check.

AML.T0053

Impact

The AI agent executes the attacker's bash command directly on the host, giving the attacker unauthorized command execution within the agent's runtime context.

AML.T0050

Initial access

A remote, low-privileged actor sends a request to the openclaw-cn gateway that exposes the bash tool's approval flow, requiring no user interaction.

Authorization bypass

The attacker exploits the incorrect-authorization logic in src/agents/bash-tools.exec.ts to have the request treated as pre-approved, skipping the intended human/policy check.

AML.T0053

Impact

The AI agent executes the attacker's bash command directly on the host, giving the attacker unauthorized command execution within the agent's runtime context.

AML.T0050

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

No patched release is currently available and the maintainer has not responded to the issue report (github.com/mf-yang/openclaw-cn/issues/563) — track that thread for a fix. As a workaround, disable or wrap the bash-tools.exec.ts execution path so it cannot be reached without an independent authorization check (e.g., enforce authN/authZ at a reverse proxy in front of the gateway, or restrict access to a trusted internal network only). Run the agent process in a sandbox/container with minimal OS privileges so a bypass does not translate into full host compromise. For detection, log every bash execution triggered by the agent and alert on any execution lacking a corresponding approval record. If the bash tool capability is not essential, disable it entirely until the vendor responds.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.1 - Operational planning and control

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-19006?

openclaw-cn's Exec Approval Flow — the gate meant to require human or policy sign-off before its AI agent runs shell commands — can be bypassed by a low-privileged remote user, letting src/agents/bash-tools.exec.ts execute commands without the intended authorization check. This matters because an approval flow is the last safety control on any agent wired to a real shell, and a bypass here effectively restores unrestricted command execution to anyone who can reach the interface with low privileges and no user interaction (CVSS 6.3, AV:N/PR:L/UI:N). VulDB indicates an exploit has already been made public, and the maintainer was notified early via a GitHub issue but has not responded, so there is no vendor patch timeline to rely on. EPSS is low (0.00209) and CISA's SSVC decision is TRACK_STAR — signaling low priority for mass, opportunistic exploitation — but that doesn't help a targeted attacker who already has a working bypass against a live deployment. Until a fix lands, disable or manually gate the bash-tools.exec.ts execution path, restrict network access to the approval gateway, and alert on any agent-triggered shell command that lacks a matching approval record.

Is CVE-2026-19006 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-19006, increasing the risk of exploitation.

How to fix CVE-2026-19006?

No patched release is currently available and the maintainer has not responded to the issue report (github.com/mf-yang/openclaw-cn/issues/563) — track that thread for a fix. As a workaround, disable or wrap the bash-tools.exec.ts execution path so it cannot be reached without an independent authorization check (e.g., enforce authN/authZ at a reverse proxy in front of the gateway, or restrict access to a trusted internal network only). Run the agent process in a sandbox/container with minimal OS privileges so a bypass does not translate into full host compromise. For detection, log every bash execution triggered by the agent and alert on any execution lacking a corresponding approval record. If the bash tool capability is not essential, disable it entirely until the vendor responds.

What systems are affected by CVE-2026-19006?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool execution / approval gateways.

What is the CVSS score for CVE-2026-19006?

CVE-2026-19006 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool execution / approval gateways

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

A remote actor with only low-level access to an openclaw-cn deployment (e.g., a standard scoped account, no special privileges) sends a crafted request to the bash-tools.exec.ts endpoint that exploits the incorrect-authorization logic in the Exec Approval Flow, causing the request to be treated as already approved. The agent proceeds to execute the attacker's bash command on the host with no human or policy check in the loop, giving the attacker command execution inside the agent's runtime context — a foothold that can be used to pivot further into the host, exfiltrate data the agent can access, or tamper with the agent's own configuration and future tool calls.

Weaknesses (CWE)

CWE-285 Improper Authorization Primary CWE-863 Incorrect Authorization Primary CWE-285 Improper Authorization CWE-863 Incorrect Authorization

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.