CVE-2026-91836

LowCVSS 2.8

Published: 15/09/2026(UTC)Updated: 20/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.

Risk Assessment

A local attacker can use the publicly known exploit to bypass static scanner logic, potentially leading to incorrect scan results and missed threats.

Recommendation

Upgrade OpenClaw ClawScan to version 0.1.7 (patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa) to remove the vulnerability.

Other vulnerabilities in OpenClaw ClawScan

CVE-2026-91835Low
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.

Original NVD description (English source)

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS