CVE-2026-110689
MediumCVSS 5.3Summary
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6 affecting the function shouldSkipTargetPath in internal/runner/runner.go of the Static Scanner component. Manipulation results in protection mechanism failure. The attack requires local access and the exploit has been publicly released.
Risk Assessment
A local attacker can bypass the scanner's protection mechanism, potentially leading to missed detection of malicious files and weakening the security posture of the environment.
Recommendation
Upgrade OpenClaw ClawScan to version 0.1.7 or later, which includes the patch identified as 9f6a6fbb9f1137345566d0ab44c73893dfe112fa.
Other vulnerabilities in OpenClaw ClawScan
See all- CVE-2026-91836Low
A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.
- CVE-2026-91835Low
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.
Original NVD description (English source)
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS