CVE-2026-100560 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The identified vulnerability in OpenClaw versions prior to 2026.8.1 represents a critical authorization bypass flaw rooted in how the application handles command-line argument validation and permission persistence on macOS and Linux operating systems. The core technical issue lies in the discrepancy between the initial approval mechanism and the subsequent execution context. When an administrator grants an Allow Always approval for a specific, exact command string, OpenClaw is intended to restrict that privilege strictly to that precise invocation. However, due to a flaw in the permission parsing logic, these granular approvals are incorrectly persisted as path-only grants rather than full-command grants. This architectural oversight means that while the system verifies the executable binary itself, it fails to validate the specific arguments passed during runtime against the originally approved set.
This technical deficiency allows an attacker or malicious actor to exploit the persistence mechanism by invoking the same authorized executable but supplying different command-line arguments that were not part of the original approval request. Because the authorization check relies primarily on the file path and ignores the argument list for already-approved binaries, the system fails to trigger a new approval prompt. Consequently, operations requiring elevated privileges or access to sensitive resources can be executed under the guise of an authorized action. This effectively nullifies the principle of least privilege by allowing actions that exceed the scope of the original user consent without additional verification steps.
The operational impact of this vulnerability is significant, particularly in environments where OpenClaw is used for automated tasks involving system administration or sensitive data processing. An attacker who gains access to a machine with an affected version can leverage trusted executables to perform unauthorized file reads, write operations, or interactions with internal services that were not explicitly approved by the administrator. This could lead to data exfiltration, privilege escalation if combined with other local vulnerabilities, or lateral movement within a network if the compromised executable has access to remote resources. The lack of re-approval for modified arguments creates a blind spot in security auditing and real-time monitoring, as standard logs may only record the execution of an authorized binary without highlighting the unauthorized argument payload.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, specifically regarding the failure to enforce appropriate access controls for different command variations. It also relates closely to CWE-732 Incorrect Permission Assignment for Critical Resource, as the permission grant is applied too broadly based on file path rather than specific execution context. In terms of adversary tactics, this behavior facilitates ATT&CK technique T1059 Command and Scripting Interpreter abuse, where attackers use legitimate system tools with malicious parameters to evade detection. The persistence aspect also touches upon T1546 Event Triggered Execution if the approval mechanism is tied to user login or session events that are not properly re-evaluated for parameter changes.
Mitigation strategies must focus on immediate patching and architectural review. Organizations running OpenClaw should upgrade to version 2026.8.1 or later, where this path-only grant logic has been corrected to enforce strict argument matching for Allow Always approvals. Until the update is applied, administrators should adopt a defense-in-depth approach by restricting file execution permissions at the operating system level using tools like SELinux on Linux or Gatekeeper and codesigning restrictions on macOS. Additionally, implementing application whitelisting solutions that validate not just the binary path but also expected command-line arguments can provide an additional layer of security. Regular auditing of approved applications should include verification of their usage patterns to detect any anomalies in argument usage that might indicate exploitation attempts.