{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19006", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-05T20:03:52.232Z", "datePublished": "2026-08-06T06:00:11.430Z", "dateUpdated": "2026-08-06T12:02:14.691Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-06T06:00:11.430Z"}, "title": "mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "mf-yang", "product": "openclaw-cn", "versions": [{"version": "2026.2.5", "status": "affected"}], "cpes": ["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"], "modules": ["Ggateway Exec Approval Flow"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-05T22:09:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "TrumpChen (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/386389", "name": "VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/386389/cti", "name": "VDB-386389 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19006", "name": "CVE-2026-19006 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/862642", "name": "Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mf-yang/openclaw-cn/issues/563", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/mf-yang/openclaw-cn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T11:55:41.918201Z", "id": "CVE-2026-19006", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T12:02:14.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19006", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T11:55:41.918201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T11:57:41.481Z"}}], "cna": {"title": "mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "credits": [{"lang": "en", "type": "reporter", "value": "TrumpChen (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"], "vendor": "mf-yang", "modules": ["Ggateway Exec Approval Flow"], "product": "openclaw-cn", "versions": [{"status": "affected", "version": "2026.2.5"}]}], "timeline": [{"lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-05T22:09:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/386389", "name": "VDB-386389 | mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/386389/cti", "name": "VDB-386389 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19006", "name": "CVE-2026-19006 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/862642", "name": "Submit #862642 | mf-yang openclaw-cn 2026.2.5 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mf-yang/openclaw-cn/issues/563", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/mf-yang/openclaw-cn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-06T06:00:11.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19006", "state": "PUBLISHED", "dateUpdated": "2026-08-06T12:02:14.691Z", "dateReserved": "2026-08-05T20:03:52.232Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-06T06:00:11.430Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.2.5"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "openclaw-cn", "source": "cna", "vendor": "mf-yang"}, "product": "openclaw-cn", "vendor": "mf-yang"}], "created": "2026-08-06T08:00:03.863539+00:00", "updated": "2026-08-06T08:15:03.935842+00:00", "vendors": ["mf-yang", "mf-yang$PRODUCT$openclaw-cn"]}