Executive brief
OpenClaw is a node orchestration and workflow automation platform. The vulnerability allows authenticated operators to bypass command allowlist restrictions on POSIX nodes by using shell metacharacters that expand to additional file operands, enabling unauthorized reading of sensitive node-local configuration files and data. This is a policy enforcement gap that requires authentication but could expose sensitive information depending on which files are accessible.
Technical details
The vulnerability exists in OpenClaw's system.run safe-bin allowlist enforcement mechanism on POSIX nodes. Before shell expansion occurs, commands are validated against an allowlist policy; however, shell metacharacters in command arguments can expand to additional arguments that change command interpretation after validation (time-of-check time-of-use / TOCTOU gap). An authenticated operator or agent can craft approved commands containing shell-expandable values that become file operands to read unintended paths. Attack preconditions include: POSIX node paired to the gateway, authenticated access to system.run, and deployment using safe-bin or allowlist-based auto-approval policies. Successful exploitation exposes node-local files such as OpenClaw configuration data. The fix is available in version 2026.5.18 or later.
Affected products
- OpenClaw OpenClaw < 2026.5.18
Timeline
- 2026-05-28: disclosed: Original advisory GHSA-mhq8-78pj-5j79 published
- 2026-06-12: advisory: CVE-2026-53831 published by NVD
- 2026-06-13: advisory: Duplicate advisory GHSA-gwcq-453v-2frr published
- 2026-05-18: patched: Patch available in version 2026.5.18
- 2026-08-25: other: GHSA-gwcq-453v-2frr withdrawn as duplicate