CVE-2026-110689: OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw ClawScan Static Scannerto a version that resolves this vulnerability.Fixed in 0.1.7Patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using OpenClaw ClawScan version 0.1.6 or earlier are affected. Exploitation requires local access and at least low privileges on the target system.
What does an attacker need to exploit the flaw?
An attacker must be able to perform a local manipulation affecting the Static Scanner's shouldSkipTargetPath function. No user interaction is required, and public exploit code is available.
What is the remediation?
Upgrade the affected OpenClaw ClawScan component to version 0.1.7. The fix is identified as patch 9f6a6fbb9f1137345566d0ab44c73893dfe112fa.