Executive brief
OpenClaw is an AI assistant and gateway tool. A security flaw in how it handles shell commands allows certain instructions to bypass safety checks and approval prompts. This could allow an authorized user to execute unauthorized commands on the underlying system, potentially leading to data theft or unauthorized system modifications.
Technical details
A vulnerability exists in OpenClaw's shell inline-command parsing logic (CWE-184). Due to an incomplete list of disallowed inputs or a logic error in the parser, specific command request forms can bypass the intended allowlist and approval mechanisms. An authenticated attacker with low privileges can exploit this over the network to execute arbitrary shell content without the required operator approval. The issue is fixed in version 2026.5.12. Mitigations include requiring manual approval for all shell inline-command forms and narrowing tool allowlists.
Affected products
- openclaw openclaw <= 2026.5.10-beta.1
Timeline
- 2026-05-28: disclosed
- 2026-06-18: advisory
- 2026-05-28: patched: First stable patched version is 2026.5.12