Executive brief
OpenClaw is a Node.js-based automation tool. A security flaw in its command approval system allows an attacker to trick administrators into authorizing malicious commands. The system may display a harmless-looking command for approval while actually executing a different, hidden malicious command in the background, potentially leading to a full system takeover.
Technical details
An approval-integrity vulnerability exists in the OpenClaw node-host 'system.run' approval workflow. The root cause is a UI mismatch where the system normalizes executables by basename and extracts inner shell payloads for display, while the underlying execution engine preserves the original, potentially malicious wrapper arguments. An attacker with low privileges can place a wrapper binary and induce a command that appears benign (e.g., 'jq --version') in the approval UI but executes an arbitrary payload (e.g., via a wrapper script) upon operator confirmation. This is classified as CWE-451 (UI Misrepresentation of Critical Information). The issue is resolved in version 2026.3.11, which binds approvals to the exact executed argv.
Affected products
- OpenClaw OpenClaw < 2026.3.11
Timeline
- 2026-03-12: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: NVD publication date
- 2026-03-11: patched: Version 2026.3.11 released