Executive brief
OpenClaw is a workflow automation platform that allows users to define and execute automation tasks, including system commands on remote nodes. A vulnerability in approval-enabled workflows allows an attacker with access to a previously approved request ID to reuse that approval with modified environment variables, bypassing the integrity controls meant to prevent unauthorized command execution. This affects organizations using OpenClaw's approval system as a security guardrail for sensitive operations.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the approval context-binding mechanism for system.run operations on host=node workflows. When approvals are enabled, the system.run approval did not maintain a strict, versioned execution-context binding; attackers with access to an approval ID could reuse that approval with modified environment variables, bypassing integrity controls. The flaw requires: (1) system.run usage through host=node, (2) exec approvals enabled, and (3) access to an approval ID. The fix, released in version 2026.2.26, introduces a required versioned binding (systemRunBindingV1) that binds approvals to command argv, working directory, agent/session context, and environment hash; legacy non-versioned fallback matching is removed.
Affected products
- OpenClaw openclaw < 2026.2.26
Timeline
- 2026-02-26: disclosed
- 2026-02-26: patched: Fix released in version 2026.2.26
- 2026-03-21: advisory: GHSA-cjq8-m7wj-xmq9 published and later withdrawn as duplicate of GHSA-hjvp-qhm6-wrh2
- 2026-03-24: other: Advisory withdrawn; consolidated under GHSA-hjvp-qhm6-wrh2