An unauthenticated local client can connect to the Gateway WebSocket API and invoke config.apply to write configuration entries. By supplying an unsafe cliPath value, the application stores the string to be used for command discovery during subsequent operations. This allows a local attacker to inject operating‑system commands that are executed on the gateway user’s behalf, leading to arbitrary code execution on the host. The weakness is a combination of missing authentication and OS command injection.

The vulnerability affects the OpenClaw personal AI assistant, versions earlier than 2026.1.20. The recommendation applies to all deployments of OpenClaw prior to that release.

The CVSS score of 8.4 reflects significant impact. While the exploit probability (EPSS) is very low (<1%) and the vulnerability is not listed in the CISA KEV catalog, the local attack requirement means that an attacker must already have local or network access to the device. Nevertheless, the absence of authentication on the WebSocket endpoint makes exploitation straightforward for any process running on or able to reach the gateway. Timely patching is therefore essential.