Executive brief
OpenClaw is a security tool that manages and controls application execution permissions through an allowlist system. A vulnerability allows attackers to bypass the exec allow-always policy when busybox or toybox shell wrappers are used, potentially enabling execution of unauthorized commands by exploiting improper wrapper detection logic.
Technical details
The vulnerability stems from incomplete wrapper analysis in OpenClaw's allowlist handling. When allow-always approvals are granted through busybox/toybox sh -c multiplexer shell wrappers, the system incorrectly treats these wrappers as non-wrapper commands and persists the wrapper binary path instead of the inner executable in the allowlist. This allows an attacker to bypass the approval mechanism by running arbitrary payloads under the same multiplexer wrapper, satisfying the stored allowlist rule. The vulnerability requires local access to invoke commands through the wrapper. The fix hardens wrapper detection and persistence behavior to bind approvals to intended inner executables and fail closed when unwrap safety is uncertain. Patched in version 2026.2.23.
Affected products
- OpenClaw OpenClaw <= 2026.2.22-2
Timeline
- 2026-03-02: disclosed: Advisory published
- 2026-02-24: patched: Fix commit a67689a7e3ad494b6637c76235a664322d526f9e released in version 2026.2.23