Executive brief
OpenClaw is an open-source execution and approval system used to control command execution in gateway and node-host environments. A flaw in how the system persists approval decisions allows an attacker to approve a benign command once, then exploit that approval to execute arbitrary different payloads without requiring new approvals—effectively bypassing all authorization controls and enabling remote code execution.
Technical details
The vulnerability is an authorization bypass (CWE-863) and OS command injection (CWE-78) stemming from wrapper-level allowlist persistence instead of validation of the inner executable intent. When an allow-always approval is granted for a wrapped system.run command in security=allowlist mode, the system persists trust at the wrapper level (env, nice, nohup, stdbuf, timeout) rather than binding approval to the actual inner executable. An attacker can submit a benign wrapped invocation for approval, then reuse that wrapper allowlist entry to execute different inner payloads on subsequent calls without triggering approval checks. The vulnerability affects gateway and node-host execution flows. Network reachability and high privileges are required; user interaction is needed for initial approval. The fix (version 2026.2.22) persists inner executable paths for known dispatch-wrapper chains and fails closed when safe unwrapping cannot be determined.
Affected products
- OpenClaw OpenClaw <= 2026.2.21-2
Timeline
- 2026-02-23: advisory: Advisory GHSA-6j27-pc5c-m8w8 published
- 2026-03-19: other: Duplicate advisory GHSA-pfv5-rpcw-x34x withdrawn