Executive brief
OpenClaw is an AI automation platform that allows networked nodes to execute tasks. A vulnerability in its node metadata validation allows an attacker controlling a paired node to supply specially-crafted Unicode text for platform identifiers that passes security checks but is interpreted differently when deciding which commands the node is allowed to run. This could allow an attacker to execute sensitive system commands that should have been blocked, potentially compromising system integrity and security controls.
Technical details
This is a Unicode canonicalization drift vulnerability (CWE-176, CWE-436) in OpenClaw's node metadata policy system. When a node is paired, its platform and deviceFamily metadata are pinned and validated for authenticity. However, the vulnerability arises because Unicode-confusable characters (characters that look similar or are canonical equivalents) are handled differently during metadata pinning validation versus command policy resolution. An attacker controlling a paired node can supply metadata with confusable Unicode characters that passes the pinning check but is classified differently when determining which commands are available, effectively bypassing policy restrictions. By exploiting this, an attacker can expand default node command allowlists to include system.run and system.which, which are normally excluded unless explicitly allowlisted. The vulnerability requires control of a paired node within the trust boundary. The fix hardens metadata canonicalization against confusables and makes unknown platform defaults conservative by excluding restricted commands by default.
Affected products
- OpenClaw openclaw <= 2026.2.26
Timeline
- 2026-03-02: disclosed: Vulnerability published
- 2026-03-01: patched: Fixed in version 2026.3.1