Executive brief
OpenClaw is a runtime orchestration and approval system used to manage code execution in distributed environments. In affected versions, the system's approval mechanism could be bypassed for interpreter and runtime commands, allowing an attacker with local access to execute unapproved code that differs from the originally approved script—for example, replacing an approved script with malicious code before execution.
Technical details
This vulnerability is a time-of-check time-of-use (TOCTOU) race condition in OpenClaw's approval flow (CWE-367). When approving node-host system.run commands, the approval system failed to bind a single concrete local file operand for certain interpreter and runtime command forms, leaving approval-integrity gaps. An attacker with local privileges and user interaction (such as timing a file modification) could alter a locally referenced script after approval but before execution, causing the runtime to execute different code than what was approved. The vulnerability affects versions up to 2026.3.8 and is fixed in 2026.3.11, where the system now fails closed and requires exact file binding for approval-backed commands.
Affected products
- OpenClaw openclaw <= 2026.3.8
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Fixed in openclaw@2026.3.11