Ghostwire

CVE-2026-42423: OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval...

HIGH CVSS 7.5

Published: April 28, 2026 | Last Modified: April 28, 2026

Description

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.

Ghostwire Analysis — What This Means Practically

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References