Executive brief
OpenClaw is a workflow automation platform that allows operators to approve and execute commands on remote hosts. This vulnerability allows an attacker to execute a different binary than what was originally approved, by changing the system's PATH environment after approval but before execution. An approved action intended to run one tool could silently execute a malicious substitute instead, potentially compromising operational security and system integrity.
Technical details
The vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) combined with untrusted search path resolution (CWE-426). For host=node runs, OpenClaw's approval mechanism validated command context but failed to pin the executable identity for non-path-like argv[0] tokens (e.g., "tr" instead of "/bin/tr"). If the system's PATH environment changed between approval and execution, the same command name could resolve to a different binary. The attack requires no authentication or user interaction; it only requires the ability to modify PATH or introduce a malicious executable in the search path before execution. The fix (2026.3.1+) requires immutable systemRunPlan data and pins path-token commands to their canonical executable identity using realpath across both approval and execution phases.
Affected products
- OpenClaw OpenClaw <= 2026.2.26; fixed in 2026.3.1
Timeline
- 2026-03-02: disclosed: GHSA-q399-23r3-hfx4 published
- 2026-03-01: patched: Fixed in version 2026.3.1