Executive brief
OpenClaw is a workflow automation and integration platform used to orchestrate tasks across distributed systems and operators. A vulnerability allows an operator's approval for executing a command on one node to be replayed and reused on different nodes within the same gateway fleet, potentially enabling unauthorized command execution on unintended targets.
Technical details
The vulnerability is an authorization bypass (CWE-285, CWE-863) in the exec approval mechanism. The root cause is that exec.approval requests for `host=node` operations were not explicitly bound to the target `nodeId`, allowing an approval token intended for one node to be replayed against different nodes under the same operator-controlled gateway. An attacker with gateway access could capture an approval response for a `system.run` request on Node A and replay it to execute the same command on Node B. The fix, released in version 2026.2.23, requires explicitly persisting the `nodeId` in approval requests and rejecting execution when the approving node binding does not match the invoking node.
Affected products
- OpenClaw openclaw <= 2026.2.22-2
Timeline
- 2026-03-02: disclosed
- 2026-02-23: patched: Version 2026.2.23 released with fix