Executive brief
OpenClaw is a tool used to manage and execute commands on remote systems. A security flaw in its Linux and macOS versions allows users to bypass restrictions that were supposed to limit which commands or arguments can be run. This could allow an attacker to perform unauthorized actions, such as accessing sensitive files or executing arbitrary commands on the host system.
Technical details
OpenClaw before version 2026.5.12 fails to properly enforce 'argPattern' restrictions within its 'exec' allowlist on Linux and macOS platforms. While the system correctly identifies the executable path, it skips the validation of the command-line arguments against configured patterns. An attacker with low privileges can exploit this by providing unauthorized arguments to allowlisted binaries (such as interpreters or system tools), leading to arbitrary command execution or unauthorized file access. This issue does not affect Windows deployments and has been addressed in version 2026.5.12.
Affected products
- OpenClaw openclaw < 2026.5.12
Timeline
- 2026-05-28: advisory: Original GHSA-v2ww-5rh7-2h5v published
- 2026-06-16: disclosed: NVD publication of CVE-2026-53853
- 2026-06-18: patched: Advisory updated to reflect patched version 2026.5.12