Executive brief
OpenClaw is a workflow execution platform used to orchestrate and manage tasks across distributed systems. A vulnerability in the Node host's system.run handler allows an attacker to bypass security allowlist restrictions and approval prompts by providing an approved command name while executing a different command with different arguments, potentially leading to unauthorized command execution on systems using the platform with allowlist-based security policies.
Technical details
The vulnerability is a logic inconsistency (CWE-284: Improper Access Control) in OpenClaw's Node host system.run handler where the rawCommand and command[] parameters are evaluated for allowlist/approval checks separately, rather than being validated for consistency. An attacker who can invoke system.run can supply an allowlisted rawCommand value while providing a different command[] argv array for actual execution. This mismatch occurs only in deployments using the node host execution path with allowlist-based exec policy (security=allowlist) and approval prompting (e.g., ask=on-miss). The attack is network-accessible if system.run is exposed, and requires only that the attacker has permission to invoke the method. The fix enforces rawCommand/command[] consistency through gateway fail-fast validation and node host-side validation.
Affected products
- OpenClaw openclaw <= 2026.2.13
Timeline
- 2026-02-17: disclosed: GHSA-h3f9-mjwj-w476 published
- 2026-02-14: patched: Planned patched version 2026.2.14