CVE-2026-91836: OpenClaw incomplete comparison

CISO Take

CVE-2026-91836 is a low-severity logic flaw (CVSS 2.8) in the static scanner of OpenClaw ClawScan up to 0.1.6, where an incomplete comparison lets a local attacker influence scan results in a way that affects integrity. Exploitation needs local access, low privileges and user interaction, and the feed shows no confirmed public exploit, no Nuclei template and no CISA KEV listing. EPSS is low (0.00325, though in the 76th percentile) and the SSVC decision is TRACK*, so this does not call for emergency response. The main concern for AI teams is that a scanner that misses findings can give false assurance about agent skills or configurations. Upgrade ClawScan to 0.1.7 (commit 9f6a6fbb) in the normal patch cycle and re-scan any artifacts that were last cleared by a vulnerable version.

Sources:NVDEPSSATLASGitHub (openclaw/clawscan)VulDB

What is the risk?

Low overall risk. The attack is local (AV:L), needs low privileges and user interaction, and affects only integrity at a low level (I:L), with no confidentiality or availability impact. EPSS is 0.00325 and the CVE is not in CISA KEV. CISA SSVC says TRACK*, meaning monitor for changes. The CVSS vector is the only exploitability data we have, and the references mention a published exploit although the structured field says none. The practical risk is a false negative from a security tool, which could let a risky AI agent component pass review.

How does the attack unfold?

Initial Access

A local user or contributor supplies a crafted agent artifact that will be passed through ClawScan.

AML.T0010.005

Exploitation

The static scanner's incomplete comparison fails to flag the artifact, so the check is bypassed.

AML.T0107

Impact

The artifact is approved on a false clean result, with a low integrity impact on the vetting process.

Initial Access

A local user or contributor supplies a crafted agent artifact that will be passed through ClawScan.

AML.T0010.005

Exploitation

The static scanner's incomplete comparison fails to flag the artifact, so the check is bypassed.

AML.T0107

Impact

The artifact is approved on a false clean result, with a low integrity impact on the vetting process.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

2.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRLow

UIRequired

SUnchanged

CNone

ILow

ANone

What should I do?

6 steps

Upgrade ClawScan to v0.1.7 or later (fix commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41).
Inventory where ClawScan runs (developer workstations, CI pipelines) and confirm the installed version.
Re-scan agent skills and components that were approved by versions 0.1.6 or earlier, prioritising anything from third-party sources.
Do not rely on a single scanner for gating; combine it with code review and sandboxed execution.
Restrict local access to the hosts and CI runners that execute the scanner.
Track the GitHub issue #40 and the VulDB entry for exploit details.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainAgentPluginAML.T0010.005- AI Agent Tool AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Third-party AI risk policies

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-91836?

CVE-2026-91836 is a low-severity logic flaw (CVSS 2.8) in the static scanner of OpenClaw ClawScan up to 0.1.6, where an incomplete comparison lets a local attacker influence scan results in a way that affects integrity. Exploitation needs local access, low privileges and user interaction, and the feed shows no confirmed public exploit, no Nuclei template and no CISA KEV listing. EPSS is low (0.00325, though in the 76th percentile) and the SSVC decision is TRACK*, so this does not call for emergency response. The main concern for AI teams is that a scanner that misses findings can give false assurance about agent skills or configurations. Upgrade ClawScan to 0.1.7 (commit 9f6a6fbb) in the normal patch cycle and re-scan any artifacts that were last cleared by a vulnerable version.

Is CVE-2026-91836 actively exploited?

No confirmed active exploitation of CVE-2026-91836 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-91836?

1. Upgrade ClawScan to v0.1.7 or later (fix commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41). 2. Inventory where ClawScan runs (developer workstations, CI pipelines) and confirm the installed version. 3. Re-scan agent skills and components that were approved by versions 0.1.6 or earlier, prioritising anything from third-party sources. 4. Do not rely on a single scanner for gating; combine it with code review and sandboxed execution. 5. Restrict local access to the hosts and CI runners that execute the scanner. 6. Track the GitHub issue #40 and the VulDB entry for exploit details.

What systems are affected by CVE-2026-91836?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI supply chain vetting, CI/CD pipelines for agent skills.

What is the CVSS score for CVE-2026-91836?

CVE-2026-91836 has a CVSS v3.1 base score of 2.8 (LOW). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI supply chain vettingCI/CD pipelines for agent skills

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Exploitation Scenario

A local user, or a malicious contributor whose submission is scanned on a developer machine or CI runner, crafts an agent skill or configuration so that the scanner's incomplete comparison treats it as matching a benign or allowed pattern. A reviewer runs ClawScan, sees a clean result and approves the artifact. The artifact is later loaded by an OpenClaw agent, where its hidden behavior runs with the agent's privileges.

Weaknesses (CWE)

CWE-1023Incomplete Comparison with Missing FactorsPrimary CWE-1023Incomplete Comparison with Missing Factors

CWE-1023 — Incomplete Comparison with Missing Factors: The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Source: MITRE CWE corpus.