Executive brief
OpenClaw is a system that controls execution of shell commands and scripts through an approval-based allowlist. This vulnerability allows attackers to bypass the approval prompt by nesting dispatch wrappers (like repeated /usr/bin/env commands), enabling unauthorized shell execution when the approval mechanism is enabled. An authenticated attacker can execute arbitrary shell commands without operator approval, circumventing critical security guardrails.
Technical details
The vulnerability exists in OpenClaw's system.run function, which has a mismatch in how it unwraps dispatch-wrapper chains. The dispatch-wrapper unwrapping logic stops at MAX_DISPATCH_WRAPPER_DEPTH, but shell-wrapper detection can return a non-wrapper result once depth is exhausted. This allows an attacker to craft nested wrapper chains (e.g., repeated /usr/bin/env) that suppress shell-wrapper detection while still matching allowlist resolution. In allowlist + ask=on-miss mode, this bypasses the expected approval prompt and allows /bin/sh -c execution without fresh approval. The attack requires authenticated gateway access. The fix (version 2026.2.24+) adds regression coverage and corrects the depth-overflow handling to deny execution when approval is required.
Affected products
- OpenClaw openclaw <= 2026.2.23
Timeline
- 2026-03-03: disclosed
- 2026-02-25: patched: Version 2026.2.24 published on npm