This vulnerability in mf-yang openclaw-cn 2026.2.5 affects an unspecified part of the file src/agents/bash-tools.exec.ts within the Ggateway Exec Approval Flow component. The flaw allows for incorrect authorization, potentially enabling an attacker with low privileges to perform unauthorized actions remotely without user interaction. The vulnerability is tracked as CWE-285 (Improper Authorization). Although an exploit is publicly available, there is no vendor response or patch at this time.

The vulnerability allows remote attackers with low privileges to bypass authorization controls, potentially leading to unauthorized information disclosure, modification, or denial of service. The CVSS 3.1 base score of 6.3 reflects low confidentiality, integrity, and availability impacts but with network attack vector and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. In the meantime, restrict network access to the affected component and apply principle of least privilege to limit potential exploitation.