Executive brief
OpenClaw is an automation tool that displays command requests for operator approval before execution. An attacker can craft a command with trailing spaces in the executable name that appears harmless to the approver but executes a different binary at runtime, allowing unauthorized command execution under the gateway's user account.
Technical details
OpenClaw's system.run approval mechanism trims whitespace from argv tokens for display rendering but does not trim whitespace during runtime execution. An attacker can inject trailing spaces into the executable token (e.g., "binary " instead of "binary") to pass approval of one command while executing a different binary with the same argv. The vulnerability is a logic error in command approval verification (CWE-436, CWE-863) that breaks the operator approval boundary. Attack requires ability to influence command argv and reuse a matching approval context. The fix is available in version 2026.2.25.
Affected products
- OpenClaw openclaw <= 2026.2.24
Timeline
- 2026-03-02: disclosed: Public disclosure on GitHub and OSV
- 2026-02-25: patched: Fix released in version 2026.2.25