Executive brief
OpenClaw is an AI automation framework that can execute commands on systems. The vulnerability allows overly broad pattern matching in the exec approval allowlist, which controls which commands are permitted to run. An attacker or misconfigured operator could use this flaw to execute commands that should have been blocked, potentially compromising system integrity and security controls.
Technical details
The matchesExecAllowlistPattern function in OpenClaw performs case-insensitive glob pattern matching without proper path boundary checking. The ? wildcard can match the / (forward slash) character, allowing patterns to cross path segments unexpectedly. Combined with case-insensitive normalization on POSIX systems (which are case-sensitive), this results in overly permissive allowlist matching that could permit execution of commands or paths an operator did not intend to approve. The vulnerability requires no authentication or network vector. The fix, released in version 2026.3.11, corrects pattern matching to respect intended path semantics and includes regression tests.
Affected products
- OpenClaw openclaw <= 2026.3.8
Timeline
- 2026-03-13: disclosed: Advisory GHSA-f8r2-vg7x-gh8m published
- 2026-03-11: patched: Fixed in openclaw 2026.3.11 and later releases