Executive brief
OpenClaw is a tool platform used to manage and control command execution on servers and endpoints. The exec allowlist feature is designed to restrict which arguments can be passed to approved executables; however, on Linux and macOS systems, this argument restriction was being skipped entirely. An attacker with the ability to trigger tool execution could bypass these restrictions and run dangerous commands (like accessing files, opening network connections, or executing code) that should have been blocked by the configured security policy.
Technical details
OpenClaw's exec allowlist feature supports optional argPattern entries to restrict which arguments are accepted for allowlisted executables. On Linux and macOS platforms, the gateway implementation failed to enforce these argPattern checks, treating a matching executable path as sufficient to satisfy the allowlist regardless of the arguments provided. This is an authorization bypass (CWE-863) and protection mechanism failure (CWE-693). The vulnerability requires: (1) exec configured with tools.exec.security set to "allowlist" mode, (2) at least one allowlist entry using argPattern, and (3) an attacker or untrusted sender able to influence tool execution. An attacker can invoke allowlisted executables with arbitrary arguments, potentially gaining unauthorized file access, network access, or command execution depending on the executable's capabilities. Windows was not affected because the code path for argPattern checks was already present. The vulnerability is patched in version 2026.5.12.
Affected products
- OpenClaw OpenClaw < 2026.5.12
Timeline
- 2026-05-28: disclosed
- 2026-05-12: patched: Version 2026.5.12 released
- 2026-06-16: advisory