This vulnerability in mf-yang openclaw-cn 2026.2.5 affects the Ggateway Exec Approval Flow component due to incorrect authorization logic in the source file src/agents/bash-tools.exec.ts. The flaw allows remote attackers to bypass intended authorization controls. The vulnerability was responsibly disclosed to the project, but no fix or official remediation has been provided. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low complexity, no privileges required, and no user interaction needed.

The incorrect authorization vulnerability allows remote attackers to perform unauthorized actions within the affected component. This could lead to unauthorized access or execution of privileged operations in the Ggateway Exec Approval Flow. The impact is rated medium based on the CVSS score of 5.3. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting network access to the affected component and applying compensating controls to limit exposure may reduce risk.