Executive brief
OpenClaw is an AI automation platform that executes commands on various systems. A flaw in its shell wrapper feature allows an authenticated user to approve one command shape but execute a different one, potentially bypassing security allowlists. This could enable an attacker to run unapproved commands if they can reach the affected feature and have authenticated access, potentially compromising system integrity depending on the operator's configuration and what lower-trust inputs are exposed.
Technical details
This vulnerability is a improper access control flaw (CWE-284) in OpenClaw's shell wrapper feature where the argv (command arguments) can be modified between the approval phase and execution phase. The root cause is a disconnect between what gets validated against the allowlist during command request approval and what actually gets executed. The attack requires the shell wrapper feature to be enabled and reachable by an authenticated Gateway operator or plugin. An attacker with authenticated access can reconstruct argv after approval to bypass the allowlist controls. The practical impact depends on whether lower-trust input can reach this code path and the operator's specific allowlist configuration. Patched in version 2026.5.18; mitigation requires explicit approval for shell wrappers and disabling the feature if not needed.
Affected products
- OpenClaw OpenClaw <= 2026.5.16
Timeline
- 2026-07-02: disclosed: Advisory published
- 2026-05-18: patched: Patched in version 2026.5.18