Executive brief
OpenClaw is a local AI assistant that uses strict approval controls to require explicit user consent before executing inline code commands. A flaw in the approval-timeout fallback mechanism allows attackers to bypass this security boundary and execute commands that should require explicit approval, potentially leading to unauthorized code execution on gateway and node execution hosts.
Technical details
The vulnerability is an improper input validation (CWE-20) and access control bypass (CWE-636) in OpenClaw's strictInlineEval approval mechanism. When an explicit approval request times out, the system falls back to an insecure state that allows inline eval commands to bypass the strictInlineEval boundary. The issue affects gateway and node execution hosts in all versions up to 2026.4.2. No authentication or user interaction is required once the timeout condition is triggered. An attacker can exploit this to execute arbitrary inline eval commands that would normally require explicit approval. The vulnerability is patched in version 2026.4.8.
Affected products
- OpenClaw OpenClaw <=2026.4.2
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Fix committed to main; available in version 2026.4.8