Executive brief
OpenClaw is a system for executing commands with policy guardrails, commonly used to restrict what commands authorized operators can run. A vulnerability allows authenticated operators to bypass these safety controls by using the env -S flag to execute commands that should have been blocked by allowlist policies, potentially enabling execution of unintended or harmful commands.
Technical details
This is a policy/allowlist bypass vulnerability (CWE-184) in OpenClaw's system.run guardrails mechanism. When /usr/bin/env is included in an allowlist, attackers can invoke env -S followed by a shell command to bypass policy analysis, causing a mismatch between what the allowlist policy analysis permits and what is actually executed at runtime. The vulnerability requires authenticated access and affects versions prior to 2026.2.23. The root cause is insufficient validation of env command arguments; when env -S is used, it can trigger shell wrapper semantics that circumvent the intended safety controls. A patch is available in version 2026.2.23 and later.
Affected products
- OpenClaw OpenClaw < 2026.2.23
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched: Version 2026.2.23 and later
- 2026-03-19: advisory