CVE-2026-43530

CVE-2026-43530 is a weakened exec approval binding vulnerability in OpenClaw versions 2026.2.23 before 2026.4.12, specifically affecting busybox and toybox applet execution. The flaw allows attackers to obscure which applet would actually run by exploiting opaque multi-call binaries, thereby bypassing exec approval mechanisms and weakening risk classification of unsafe applet invocations. Published on 2026-05-05, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-863 (Incorrect Authorization).

Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation enables high-impact outcomes on confidentiality, integrity, and availability (C:H/I:H/A:H), allowing adversaries to execute unintended or unsafe applets while evading approval checks and risk assessments.

Mitigation details are provided in official advisories, including a patch commit at https://github.com/openclaw/openclaw/commit/666f48d9b882a8a1415ca53f9567c72499d850c9, the GitHub Security Advisory GHSA-2cq5-mf3v-mx44 at https://github.com/openclaw/openclaw/security/advisories/GHSA-2cq5-mf3v-mx44, and analysis from VulnCheck at https://www.vulncheck.com/advisories/openclaw-weakened-exec-approval-binding-via-busybox-and-toybox-applet-execution. Upgrading to OpenClaw 2026.4.12 or later addresses the issue.