Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42423 Approval-Timeout Bypass in OpenClaw Before 2026.4.8 Circumvents Inline Eval Requirements https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42423
Post summary
A short disclosure announces an approval-timeout bypass vulnerability in OpenClaw versions before 2026.4.8, describing how it circumvents inline eval requirements, but no PoC, exploit, or mitigation details are provided.
CVE-2026-42423 OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts.… https://www.cve.org/CVERecord?id=CVE-2026-42423
Post summary
The post discloses CVE‑2026‑42423, detailing an approval‑timeout fallback that circumvents strictInlineEval approval checks on OpenClaw gateway and node exec hosts.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |