Executive brief
OpenClaw is a platform that manages execution policies and allowlists for system commands. Versions prior to 2026.2.22 fail to properly analyze wrapper binaries like `env` and shell-dispatch chains, allowing attackers to bypass command allowlist restrictions by routing execution through these wrappers. An authenticated actor could execute non-allowlisted commands while appearing to comply with the allowlist policy.
Technical details
The vulnerability is an authorization bypass (CWE-863) and OS command injection (CWE-78) in OpenClaw's exec allowlist policy enforcement. The system.run function's allowlist analysis treats wrapper binaries (env, shell-dispatch) as the effective executable rather than unwrapping the chain to identify the actual command being executed. An authenticated attacker can trigger system.run requests under an allowlist policy and bypass restrictions by constructing commands like `env bash -lc "smuggled command"` that satisfy the allowlist entry for `env` or `bash` while executing non-allowlisted payloads. The vulnerability requires authentication (PR:L in CVSS v3) and network access. Fix commit 2b63592 hardens wrapper resolution by treating env and shell-dispatch wrappers as transparent during allowlist analysis on affected platforms (node-host, macOS).
Affected products
- OpenClaw openclaw < 2026.2.22
Timeline
- 2026-02-23: disclosed: Advisory GHSA-jj82-76v6-933r published
- 2026-02-22: patched: Fix commit 2b63592 authored; patched version 2026.2.22 released
- 2026-03-19: advisory: Duplicate advisory GHSA-3846-mfvc-xwpf published
- 2026-03-20: other: GHSA-3846-mfvc-xwpf withdrawn as duplicate