OpenClaw Codex before 2026.7.1 fails to enforce the correct owner checks when adding native conversation bindings. A user who is not the channel owner but who has command‑level access can create a binding that hooks into the native Codex runtime. Through the binding the attacker can invoke host‑capable turns, which provide direct access to files, tools, and processes on the host machine. The result is a privilege escalation that enables arbitrary code execution on the underlying system. This weakness is identified by CWE‑269.

Vulnerable instances are OpenClaw Codex from the vendor OpenClaw, specifically all releases prior to version 2026.7.1. No other products or versions are listed as affected.

The CVSS score of 8.7 indicates a high severity flaw. The EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified, yet the absence of a KEV listing means no confirmed public exploitation yet. Nevertheless, the flaw can be triggered by any user with command privileges in a non‑owner channel, making it a potent threat for organizations that run the affected product. Immediate patching is recommended to eliminate the opportunity for attackers to execute host‑level code.