Executive brief
OpenClaw is a Node.js security module that manages command execution approval policies. A flaw in its wrapper command persistence allows attackers with high privileges and user interaction to bypass approval restrictions by re-using cached allowlist entries, enabling arbitrary command execution on subsequent invocations without re-approval.
Technical details
The vulnerability is an authorization bypass (CWE-863) combined with OS command injection (CWE-78) in the allow-always wrapper persistence mechanism. When a user approves a wrapped system.run command (e.g., via env, nice, nohup, stdbuf, or timeout wrappers) with allow-always in allowlist mode, the system incorrectly caches the approval at the wrapper level rather than the inner executable level. This allows a later invocation of the same wrapper with a different inner payload to execute without requiring new approval. The attack requires network access, high privileges, and user interaction to approve the initial wrapped command. The fix (version 2026.2.22) correctly persists inner executable paths for known wrapper chains and fails safely when unwrapping cannot be reliably determined.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-02: disclosed
- 2026-02-23: patched: Patched version 2026.2.22 announced