CVE-2026-101880

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval

score 15HIGH 8.7

Summary

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

Published 2026-09-30 · first seen here 2026-10-10

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

Windows or Active Directory · Authentication bypass or missing authorisation high confidence

What to look for

Admin or API actions with no successful login before them in the same session
New admin accounts, API keys or tokens created shortly after unusual requests
Requests to admin or API endpoints from internet IPs
Processes running as SYSTEM whose parent is a normal user process
New local or domain admin accounts, or users added to privileged groups
Unusual logons (type 3 or 10) to servers right before suspicious processes start

Data sources

Process creation · ATT&CK DS0009 Process Creation

Sentinel: DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate
Splunk: Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)
CrowdStrike: ProcessRollup2SyntheticProcessRollup2

Authentication and sessions · ATT&CK DS0028 Logon Session Creation / DS0002 User Account Authentication

Sentinel: SigninLogsSecurityEvent (4624, 4625, 4648)DeviceLogonEventsIdentityLogonEvents_Im_Authentication
Splunk: Authentication.Authenticationpan:globalprotectVPN sourcetypes
CrowdStrike: UserLogonUserLogonFailed2Falcon Identity Protection events

Account and group changes · ATT&CK DS0002 User Account Creation / Modification

Sentinel: SecurityEvent (4720, 4728, 4732, 4756)AuditLogsIdentityDirectoryEvents
Splunk: Change.All_Changes (Account_Management)WinEventLog:Security (4720, 4732)
CrowdStrike: UserAccountCreatedUserAccountAddedToGroup