PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110689 OpenClaw CVE debrief

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6, impacting the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. This results in a protection mechanism failure, requiring local attack. Upgrading to version 0.1.7 fixes this issue, with the patch named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa.

Vendor
OpenClaw
Product
ClawScan
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for OpenClaw ClawScan Static Scanner deployments should assess exposure and prioritize upgrading to version 0.1.7. They should also verify the presence of patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa in their deployments. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-110689 is a protection mechanism failure in OpenClaw ClawScan Static Scanner, requiring local exploitation. Defenders should prioritize upgrading to version 0.1.7 and applying patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa.

  • Local attackers may exploit this vulnerability to bypass protection mechanisms.
  • Successful exploitation requires local access to the affected system.
  • Defenders should verify the presence of patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa in their deployments.
  • Upgrading to version 0.1.7 will mitigate this protection mechanism failure.

Technical summary

The OpenClaw ClawScan Static Scanner has a protection mechanism failure in the shouldSkipTargetPath function of the internal/runner/runner.go file. This issue affects versions up to 0.1.6 and is fixed in version 0.1.7 with patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. Defenders should prioritize upgrading to version 0.1.7 and applying the patch to mitigate the protection mechanism failure in OpenClaw ClawScan Static Scanner. The vulnerability requires local attack, and successful exploitation can result in protection mechanism failure.

Defensive priority

Defenders should prioritize upgrading to version 0.1.7 and applying the patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa to mitigate the protection mechanism failure in OpenClaw ClawScan Static Scanner.

Recommended defensive actions

  • Upgrade to version 0.1.7
  • Apply patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa
  • Review and update affected systems
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenClaw ClawScan up to 0.1.6, including the affected component, patch, and fixed version. Defenders should verify the presence of patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa in their deployments. The vulnerability requires local exploitation, and upgrading to version 0.1.7 will mitigate this protection mechanism failure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110689 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110689

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110689 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110689

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110689.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/419836

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/419836/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-110689

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1003915

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/openclaw/clawscan/issues/39

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/openclaw/clawscan/pull/41

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nedlir/skills-scanner-bypass

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.