Executive brief
OpenClaw is an agent-based automation platform. A security flaw in its Skill Workshop component allows automated tools to bypass required approval steps when applying changes. This could result in unauthorized modifications to the system's configuration or behavior without the oversight of a human operator.
Technical details
A vulnerability classified as Reliance on Untrusted Inputs in a Security Decision (CWE-807) exists in OpenClaw's Skill Workshop. In affected versions, an agent tool call reaching the Skill Workshop apply path can programmatically set 'apply: true' even when the 'approvalPolicy' is set to 'pending'. This bypasses the intended manual approval step. Exploitation requires the feature to be enabled and reachable by lower-trust input, typically involving network-based interaction with a high degree of complexity and user interaction. The issue is patched in version 2026.5.6.
Affected products
- openclaw openclaw <= 2026.5.5
Timeline
- 2026-05-28: disclosed: Initial report by zsxsoft/KeenSecurityLab
- 2026-07-02: advisory: GitHub Advisory GHSA-cqwv-9qjx-vxw2 published
- 2026-05-28: patched: Version 2026.5.6 released