OpenClaw versions from 2026.3.22 up to but not including 2026.8.1 contain a flaw in the exec approval policy. The policy can trust a wrapper program that is allowed by the operator without inspecting the command passed to it. After an operator approve or permanently allow a benign wrapper, a later invocation can replace the inner command with any payload and execute it with the OpenClaw process’s host privileges, bypassing the approval prompt. The vulnerability is a classic authentication bypass (CWE-88) that can lead to local or remote code execution depending on who can influence the wrapper invocation.

Products affected are OpenClaw from version 2026.3.22 through 2026.8.0. The vulnerability applies to all platforms supported by OpenClaw with this bundled exec approval policy. No specific additional vendors or versions are listed.

The CVSS score of 8.6 indicates high severity, and while the EPSS score is not reported, the flaw requires an operator to have already allowed a particular wrapper, which is a significant prerequisite. It is not listed in the CISA KEV catalog. The typical attack path would involve a privileged operator or an attacker who can trick an operator into permitting a wrapper, or a malicious actor who can exploit an already approved wrapper on the host. Once sufficient conditions are met, the attacker can execute arbitrary commands with host-level privileges.