Executive brief
OpenClaw is a distributed task execution platform used to run scripts and commands across nodes. This vulnerability allows attackers to bypass approval controls by modifying local scripts between the approval review and actual execution, leading to unintended code execution with OpenClaw runtime privileges. An attacker with local access and low privileges can exploit this by changing an approved benign script to malicious code before it executes.
Technical details
This is a time-of-check–time-of-use (TOCTOU) race condition in OpenClaw's approval integrity mechanism for node-host system.run operations. The vulnerability occurs when OpenClaw cannot bind exactly one concrete local file operand during approval planning for interpreter and runtime commands—it still marks them as approval-backed despite leaving residual integrity gaps. An attacker with local access and at least low privileges can modify an approved script file between the approval phase and execution, causing different code to run than what was reviewed. The fix, released in openclaw@2026.3.11, enforces fail-closed behavior by rejecting interpreter and runtime commands that cannot bind exactly one concrete local file operand, and extends direct-file binding to additional runtime forms.
Affected products
- OpenClaw OpenClaw <= 2026.3.8
Timeline
- 2026-03-12: disclosed
- 2026-03-11: patched: Fix released in openclaw@2026.3.11
- 2026-03-29: advisory: GHSA-wmgj-hrx3-23gj published
- 2026-04-06: other: GHSA-wmgj-hrx3-23gj withdrawn as duplicate of GHSA-xf99-j42q-5w5p