CVE-2026-100561: OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using OpenClaw versions 2026.3.22 through before 2026.8.1 are exposed if an operator has allowlisted or permanently approved a command-running wrapper and that wrapper resolves on the host. The issue can affect transparent shell carriers as well as opaque utilities including process monitors, tracers, namespace tools, and proxy wrappers.
What does an attacker need to exploit it?
An attacker needs a previously allowed or permanently approved wrapper invocation and a relevant wrapper binary that resolves on the host. They can then substitute an arbitrary command in the wrapper's arguments during a later agent turn, without triggering another approval prompt.
What is the impact of successful exploitation?
A successful bypass allows an arbitrary inner command to run with the host privileges of the OpenClaw process. This can affect confidentiality, integrity, and availability.
What should be done if an immediate upgrade is not possible?
Remove or avoid permanent approvals and allowlist entries for command-running wrappers, particularly shell carriers, process monitors, tracers, namespace tools, and proxy wrappers. This reduces the prior operator approval condition required for exploitation.
How can I remediate the vulnerability?
Upgrade OpenClaw to version 2026.8.1 or later. The flaw affects versions starting at 2026.3.22 and ending before 2026.8.1.