Executive brief
OpenClaw is a workflow automation platform that executes tasks and commands on behalf of users. When configured with non-default settings (autoAllowSkills=true), a vulnerability allows attackers to bypass approval prompts for certain commands by exploiting how the system matches executable names, potentially allowing unauthorized command execution without operator confirmation.
Technical details
The vulnerability is an authorization bypass in OpenClaw's skill allowlist evaluator affecting versions up to 2026.2.22-2. The flaw occurs when autoAllowSkills is enabled: the allowlist matcher accepts skill satisfaction by basename alone, so a path-scoped executable like ./skill-bin could resolve to the basename "skill-bin" and match an allowlisted skill without requiring approval. An attacker who can influence executable paths or names in a non-default configuration could bypass the ask=on-miss approval prompt. The fix hardens matching to require pathless invocation tokens (no "/" or "\") and trusts only resolved executable paths, preserving legitimate usage while preventing path-based collisions. The vulnerability requires non-default configuration and does not affect default installations.
Affected products
- OpenClaw openclaw <= 2026.2.22-2
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched: Fix released in version 2026.2.23
- 2026-03-03: advisory