CVE-2026-110689

CVSS 5.3 (medium) · published 2026-10-14

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Weakness: CWE-693

Source: NVD CVE-2026-110689

References

• https://github.com/nedlir/skills-scanner-bypass
• https://github.com/openclaw/clawscan/
• https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa
• https://github.com/openclaw/clawscan/issues/39
• https://github.com/openclaw/clawscan/pull/41
• https://github.com/openclaw/clawscan/releases/tag/v0.1.7
• https://vuldb.com/cve/CVE-2026-110689
• https://vuldb.com/submit/1003915
• https://vuldb.com/vuln/419836
• https://vuldb.com/vuln/419836/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.