Executive brief
OpenClaw is an open-source orchestration and automation platform that allows operators to execute commands through a controlled allowlist. A vulnerability in this allowlist mechanism permits authenticated operators to bypass restrictions by crafting requests that exploit transparent command wrappers, potentially performing unintended operations outside the scope of approved commands. This could enable privilege escalation or unintended system modifications depending on the operator's configured permissions and the nature of available wrapper commands.
Technical details
The vulnerability is an incomplete allowlist bypass (CWE-184, CWE-78) in OpenClaw's exec allowlist validation logic. When a command request reaches the allowlist evaluation path, the validation checks only the inner command against the allowlist while the wrapper invocation still executes, allowing wrapper-level side effects to occur outside the intended allowlisted command. This affects versions up to 2026.5.22. Authentication is required; the attacker must be a trusted Gateway operator. The fix is to patch to version 2026.5.26 or later. Mitigations include careful review of wrapper commands, requiring approval for shell-like wrappers, keeping allowlists narrow, and disabling the feature if not needed.
Affected products
- OpenClaw OpenClaw before 2026.5.26
Timeline
- 2026-05-28: disclosed: Advisory published for primary GHSA-cwpp-5962-q4f6
- 2026-06-16: other: Duplicate advisory GHSA-wrr6-p5r6-474m published
- 2026-06-18: other: GHSA-wrr6-p5r6-474m withdrawn as duplicate