Executive brief
OpenClaw is a workflow automation platform that executes system commands on remote nodes with approval-based access control. Authenticated operators can exploit a command parsing flaw to inject malicious arguments after cmd.exe /c on Windows nodes, executing arbitrary commands while the audit trail shows only the benign portion. This allows attackers to perform unauthorized actions on trusted Windows infrastructure while bypassing audit visibility.
Technical details
The vulnerability is an argument injection (CWE-88) and improper authorization (CWE-863) flaw in OpenClaw's system.run command handling on Windows. When processing cmd.exe /c commands, the application fails to canonicalize the full command tail before matching against approval records and generating audit logs. An authenticated operator with approval.write and operator.approvals scopes can request execution of a benign command (e.g., "echo"), but inject additional arguments after cmd.exe /c that are silently executed on the Windows node while the approval and audit text reflects only the originally-approved benign command. The fix involves canonicalizing the full command tail after cmd.exe /c, reusing a shared validation path for approval matching and execution, and adding regression test coverage for trailing-argument smuggling. Patch available in version 2026.2.21.
Affected products
- OpenClaw OpenClaw <=2026.2.19-2
Timeline
- 2026-03-02: disclosed: GHSA-5v6x-rfc3-7qfr published
- 2026-02-21: patched: Fix commit 6007941f04df1edcca679dd6c95949744fdbd4df prepared; patched version 2026.2.21 planned
- 2026-03-18: advisory: NVD published CVE-2026-22168
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5v6x-rfc3-7qfr
- https://github.com/openclaw/openclaw/commit/6007941f04df1edcca679dd6c95949744fdbd4df
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmd-exe-c-trailing-arguments-in-system-run