Executive brief
OpenClaw is a runtime policy enforcement system used to control command execution in sandbox environments. The vulnerability allows an attacker to bypass binary allowlist checks by placing a same-named executable in a trusted PATH directory, enabling unauthorized command execution when allowlist mode relies on safe-bin validation.
Technical details
The vulnerability exists in OpenClaw's tools.exec.safeBins implementation when running in allowlist mode. The root cause is that safe-bin trust accepts PATH-derived directories instead of explicit trusted directories, and shell command tokens used during execution can resolve to shadowed binaries. An attacker who can influence trusted binary locations (such as modifying PATH or placing files in trusted directories) can satisfy safe-bin checks and achieve command execution in the OpenClaw runtime context. This is a CWE-426 (Untrusted Search Path) issue that allows an allowlist bypass. A patch is available in version 2026.2.22 and later.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-02-23: disclosed
- 2026-03-03: advisory
- 2026-02-22: patched: Fix commit 64b273a71cf0b2f2419c974832cede1fc2158729; patched version 2026.2.22 planned