CVE-2026-100584: OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory. If lower-trust content can place an executable with an approved basename into an agent-writable workspace and steer an approved PowerShell command that uses a bare executable name, OpenClaw may run the workspace file instead of the allowlisted path, executing arbitrary code with the privileges of the Gateway or node-host user. The issue does not require replacement of the approved executable itself. Version 2026.7.1 contains a fix; as a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.7.1 - Compensating control
As a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Windows hosts running OpenClaw versions 2026.2.26 through before 2026.7.1 are affected when exec allowlist mode is used and approved PowerShell commands invoke executables by bare name.
What conditions are required for exploitation?
Lower-trust content must be able to place a same-named executable in an agent-writable workspace and influence an approved PowerShell command that uses a bare executable name. The attacker does not need to replace the approved executable resolved from PATH.
What is the impact if exploitation succeeds?
The workspace executable may run instead of the allowlisted executable, allowing arbitrary code execution with the privileges of the Gateway or node-host user.
What can be done before upgrading?
Avoid bare executable names in approved PowerShell commands, and prevent executable files from being placed in agent-writable workspaces. Upgrade to version 2026.7.1 when possible.