Executive brief
OpenClaw is an AI automation platform that uses paired node connections for distributed command execution. The vulnerability allows a compromised paired node to forge fake command execution results and send them to the gateway without proper verification. An attacker controlling a paired node could trick the gateway into believing commands executed that never actually ran, potentially gaining unauthorized access to capabilities and data.
Technical details
OpenClaw has an insufficient authorization vulnerability (CWE-862, CWE-863, CWE-284) in its node event handling logic. The gateway accepts exec lifecycle events from paired nodes without validating that they correspond to actual authorized system.run requests, creating a missing provenance check at the node event boundary. An attacker must already have control of a paired node connection (network-adjacent or local compromise), but can then craft malicious node.event messages that cause the gateway to process attacker-supplied data as legitimate exec lifecycle results. This allows the attacker to steer target sessions into exec-event code paths that expose capabilities the reduced node surface should not provide. The vulnerability is patched in version 2026.5.18 and later.
Affected products
- openclaw openclaw < 2026.5.18
Timeline
- 2026-05-28: disclosed
- 2026-07-02: advisory
- 2026-05-28: patched: Fixed in version 2026.5.18