Executive brief
OpenClaw, a tool used for system execution and orchestration, contains a security flaw in how it validates environment variables during its approval process. An attacker could bypass security reviews by using specific Windows-compatible variable names that the system ignores during approval but honors during execution. This could allow an unauthorized user to run commands with modified settings or execute malicious files, potentially compromising the integrity of the system.
Technical details
An approval bypass vulnerability exists in OpenClaw due to a discrepancy between the environment variable normalization logic used during the approval phase and the execution phase. The approval binding path used a 'portable-only' normalization (discarding keys with parentheses), while the execution path used a broader Windows-compatible normalization. An attacker with low privileges can provide environment overrides (e.g., using keys like 'ProgramFiles(x86)') that are ignored during the hash computation for operator approval but are subsequently injected into the runtime environment. This allows for the execution of attacker-controlled binaries or the manipulation of runtime behavior without valid operator consent. The issue is fixed in version 2026.4.2 by aligning the normalization logic across both paths.
Affected products
- OpenClaw openclaw < 2026.4.2
Timeline
- 2026-04-01: other: Fix submitted via pull request
- 2026-04-02: disclosed: Initial advisory published
- 2026-04-10: patched: Final patch and advisory update published
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-98ch-45wp-ch47
- https://github.com/openclaw/openclaw/pull/59182
- https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7
- https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization