CVE-2026-100561 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions ranging from 2026.3.22 up to but not including 2026.8.1 represents a critical failure in the application's command execution approval mechanism, specifically classified under CWE-94 as Improper Control of Generation of Code (Code Injection) and CWE-77 as Command Injection via Wrapper Programs. This flaw stems from an insufficient validation strategy within the exec approval policy, which fails to inspect the actual arguments passed to a command-running wrapper after initial authorization has been granted. The core technical deficiency lies in the system's trust model, where once an operator explicitly allows or permanently approves a specific wrapper invocation based on its primary executable path, the security context assumes that all subsequent executions of that same wrapper are benign and safe. This assumption ignores the dynamic nature of command-line arguments, allowing for significant divergence between the approved intent and the actual executed action.
Operationally, this architectural weakness enables an attacker or malicious agent to bypass human-in-the-loop approval controls through argument substitution during later execution turns. After a legitimate operator has whitelisted a wrapper tool, such as a process monitor, tracer, namespace manipulation utility, or proxy script, subsequent invocations can embed arbitrary inner commands within the arguments of that approved wrapper. Because OpenClaw executes these wrappers with host-level privileges, the substituted command inherits this elevated access level without triggering any further approval prompts. This effectively neutralizes the security boundary intended by the approval policy, as the system trusts the container (the wrapper) rather than its contents or parameters. The impact is severe, allowing for unauthorized code execution on the host machine under the context of the OpenClaw process, which typically possesses broad permissions necessary for development and operational tasks.
The scope of this vulnerability extends beyond simple shell scripts to include opaque utilities that may not be immediately recognizable as command carriers by static analysis tools or human reviewers. Tools such as tracers like strace, namespace management utilities, and various proxy wrappers were affected due to similar trust-resolution gaps where the system failed to parse or validate internal arguments against a whitelist of allowed sub-commands or patterns. This creates a persistent risk vector even after initial remediation steps are taken if legacy configurations remain in place. The vulnerability aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter abuse, where attackers use legitimate system utilities to execute malicious payloads while evading detection by security tools that rely on known bad signatures rather than behavioral analysis of argument injection.
Mitigation for this issue requires immediate upgrading to OpenClaw version 2026.8.1 or later, which addresses the root cause by implementing strict validation of command arguments within approved wrappers. In environments where upgrades are not immediately feasible, administrators should enforce stricter allowlists that specify not only permitted wrapper executables but also their allowed argument patterns and sub-commands. Additionally, adopting a principle of least privilege for the OpenClaw process can limit the blast radius if exploitation occurs. Security teams should audit existing approval policies to remove permanent approvals for generic wrappers unless absolutely necessary, preferring temporary or context-specific approvals that expire after use. Continuous monitoring of command execution logs for unusual argument patterns in approved tools is also recommended to detect potential exploitation attempts before they result in full system compromise.