{"id":"CVE-2026-19006","state":"PUBLISHED","title":"mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization","description":"A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","publishedAt":"2026-08-06T06:00:11.430Z","updatedAt":"2026-08-06T12:02:14.691Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["mf-yang openclaw-cn"],"affected":[{"vendor":"mf-yang","product":"openclaw-cn","versions":[{"version":"2026.2.5","status":"affected"}],"cpes":["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"],"modules":["Ggateway Exec Approval Flow"]}],"references":["https://vuldb.com/vuln/386389","https://vuldb.com/vuln/386389/cti","https://vuldb.com/cve/CVE-2026-19006","https://vuldb.com/submit/862642","https://github.com/mf-yang/openclaw-cn/issues/563","https://github.com/mf-yang/openclaw-cn/"],"weaknesses":["CWE-863","CWE-285"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19006.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19006","state":"PUBLISHED","datePublished":"2026-08-06T06:00:11.430Z","dateUpdated":"2026-08-06T12:02:14.691Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-05T20:03:52.232Z"},"containers":{"cna":{"title":"mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization","descriptions":[{"lang":"en","value":"A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"vendor":"mf-yang","product":"openclaw-cn","versions":[{"version":"2026.2.5","status":"affected"}],"cpes":["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"],"modules":["Ggateway Exec Approval Flow"]}],"references":[{"url":"https://vuldb.com/vuln/386389","name":"VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/386389/cti","name":"VDB-386389 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19006","name":"CVE-2026-19006 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/862642","name":"Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)","tags":["third-party-advisory"]},{"url":"https://github.com/mf-yang/openclaw-cn/issues/563","tags":["exploit","issue-tracking"]},{"url":"https://github.com/mf-yang/openclaw-cn/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"Incorrect Authorization"}]},{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-06T06:00:11.430Z"},"timeline":[{"time":"2026-08-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-05T22:09:07.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"TrumpChen (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-06T11:55:41.918201Z","id":"CVE-2026-19006","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-06T12:02:14.691Z"}}]}}}