OpenClaw package does not enforce per‑chat tool policies for Codex app‑server runtime tools, allowing an attacker to trigger the shell, process, file, and patch tools even when a conversation is restricted. The flaw effectively bypasses the configured allowlist and enables execution of arbitrary native commands, potentially leading to data exposure or system compromise. The weakness is a failure to enforce access control (CWE‑863).

This issue affects the OpenClaw npm package, prior to version 2026.8.1, which runs in the Codex app‑server runtime environment. Any instance using a lower‑trust conversation that is restricted by a per‑chat tool allowlist is vulnerable if the host permissions and sandbox configuration permit native tool execution.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available but the lack of a KEV listing does not diminish the potential impact. The vulnerability can be exploited by any user who can trigger the agent in a restricted conversation, making it likely that an attacker could achieve remote code execution in the host environment. The risk is high and requires immediate attention.