Executive brief
OpenClaw is a Node.js-based automation and execution platform. In setups that use approval workflows to control script execution integrity, a previously approved request could be re-executed with modified environment variables without requiring a new approval. This affects only configurations that rely on approvals as an integrity control.
Technical details
The vulnerability is a context-binding weakness in the approval matching logic for system.run operations in host=node workflows. The root cause is the lack of strict, versioned execution-context binding in approval validation—specifically, env input was not properly hashed or verified as part of the approval token. An attacker with access to a previous approval ID could reuse it with different environment variables, bypassing the integrity guardrail that approvals are meant to provide. This requires: system.run usage via host=node, approval-enabled configurations, and access to an approval ID. The fix implements mandatory versioned binding (systemRunBindingV1) over command argv, working directory, agent/session context, and environment hash, and removes legacy non-versioned fallback matching. A patch is available in version 2026.2.26.
Affected products
- OpenClaw Node <= 2026.2.25
Timeline
- 2026-03-02: disclosed
- 2026-02-26: patched: Fix planned for release 2026.2.26