Executive brief
OpenClaw is a node orchestration and command execution platform used to manage developer workstations, CI runners, and servers. An authenticated attacker can bypass security approval workflows in the gateway and execute arbitrary commands on connected nodes, potentially compromising entire infrastructures of developers, CI systems, and production servers.
Technical details
The vulnerability is an improper input validation and authorization bypass (CWE-20, CWE-863, CWE-441) in the gateway's node.invoke method for system.run commands. The gateway forwards user-controlled parameters to node hosts without sanitizing internal approval control fields; node hosts treat params.approved === true or params.approvalDecision as sufficient to skip the approval gating workflow. An attacker who can authenticate to the gateway (via leaked token, shared credentials, or operator.write paired device token) can inject these fields to bypass exec approvals and execute arbitrary commands on all connected node hosts supporting system.run. The attack requires only network access and prior authentication; no user interaction is needed. Patched in OpenClaw 2026.2.14 via input sanitization, approval record validation, device-identity binding, and allowlist filtering.
Affected products
- OpenClaw OpenClaw all versions before 2026.2.14
Timeline
- 2026-03-02: disclosed
- 2026-02-14: patched: Version 2026.2.14 released with fixes