Executive brief
OpenClaw is a workflow automation platform used to manage and execute tasks across distributed nodes. In POSIX environments, the system.run safe-bin feature—which controls which commands operators can execute—could be bypassed through shell metacharacter expansion, allowing authenticated operators to read arbitrary node-local files and access sensitive configuration data that should be restricted.
Technical details
This vulnerability is a policy enforcement gap in OpenClaw's argv validation for the system.run safe-bin allowlist on POSIX nodes. The root cause is insufficient shell expansion neutralization: approved commands are validated before shell expansion occurs, but shell metacharacters in arguments can expand into additional words that change how the command is interpreted, allowing file operand substitution. Attack requires: authenticated access to the gateway, a POSIX node paired to the system, system.run reachable, and an exec policy using safe-bin or allowlist-based auto-approval. An attacker can exploit this to read unintended node-local files, potentially exposing OpenClaw configuration or other sensitive node data. This is not a complete unauthenticated takeover—it is limited to authenticated operators abusing safe-bin bypass. Fixed in version 2026.5.18.
Affected products
- OpenClaw OpenClaw before 2026.5.18
Timeline
- 2026-05-28: disclosed
- 2026-05-18: patched: Patched version 2026.5.18 released