Detections
Analytics

SCA: security update for openclaw (GHSA-h3f9-mjwj-w476)

high Tenable Self-Hosted Container Security Plugin ID 437788

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and
 `command[]` in the node host `system.run` handler could cause allowlist/approval evaluation to be
 performed on one command while executing a different argv. This only impacts deployments that use the node
 host / companion node execution path (`system.run` on a node), enable allowlist-based exec policy
 (`security=allowlist`) with approval prompting driven by allowlist misses (for example `ask=on-miss`),
 allow an attacker to invoke `system.run`. Default/non-node configurations are not affected. Version
 2026.2.14 enforces `rawCommand`/`command[]` consistency (gateway fail-fast + node host validation).
 (CVE-2026-26325)

See Also

https://github.com/advisories/GHSA-h3f9-mjwj-w476

Plugin Details

Severity: High

ID: 437788

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 2/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-26325

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/17/2026

Vulnerability Publication Date: 2/17/2026

Reference Information

CVE: CVE-2026-26325

cwe: CWE-284