Multiple OpenClaw Flaws Enable Code Execution and Consent Bypass

OpenClaw disclosed several high-severity vulnerabilities that can lead to arbitrary code execution and security control bypass across recent releases. CVE-2026-35641 affects versions before 2026.3.24 and lets a malicious local plugin or hook package use a crafted .npmrc file to override the git executable during npm install, resulting in arbitrary program execution. CVE-2026-41349 affects versions before 2026.3.28 and allows low-privileged remote attackers to bypass execution approval through config.patch, silently disabling agentic consent protections. Belgium's Centre for Cybersecurity warned that multiple OpenClaw flaws can lead to RCE and urged immediate patching.

Additional OpenClaw issues published shortly after expand the attack surface. CVE-2026-41336 affects versions before 2026.3.31 and allows workspace .env files to override OPENCLAW_BUNDLED_HOOKS_DIR, causing trusted bundled hooks to be replaced with attacker-controlled code from untrusted workspaces. CVE-2026-41352, also fixed in 2026.3.31, allows a device-paired node to bypass the node scope gate and execute arbitrary node commands on the host without proper pairing validation. Separately, the Node.js package simple-git disclosed CVE-2026-6951, an RCE flaw in versions before 3.36.0 caused by incomplete blocking of Git configuration options, allowing attackers to abuse --config, enable protocol.ext.allow=always, and trigger execution through an ext:: clone source when untrusted input reaches the library's options.