Executive brief
OpenClaw is a system execution control library that enforces allowlists to restrict which commands can be run. The vulnerability allows authenticated users to bypass these security restrictions by routing execution through wrapper binaries like env or shell dispatchers, effectively executing non-approved commands while appearing to run allowlisted ones.
Technical details
This is an authorization bypass vulnerability (CWE-78, CWE-863) in OpenClaw's system.run exec allowlist wrapper analysis. The vulnerable component fails to fully unwrap shell dispatch chains (e.g., env, bash wrappers), treating the wrapper binary itself as the effective executable rather than analyzing what the wrapper will ultimately execute. An authenticated actor with the ability to trigger system.run requests under an allowlist policy can craft payloads like "env bash -lc ..." that satisfy the allowlist check for the wrapper while executing non-allowlisted commands. The attack requires prior authentication and existing system.run privileges. Versions 2026.2.21-2 and earlier are affected; a fix was released in version 2026.2.22.
Affected products
- OpenClaw OpenClaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed: Vulnerability published
- 2026-02-22: patched: Fix released in version 2026.2.22