OpenClaw versions before 2026.3.7 allow a shell approval gating bypass when system.run uses a dispatch wrapper. The bypass relies on a depth‑boundary mismatch between the approval classifier and the execution planner, letting an attacker supply exactly four dispatch wrappers that are erroneously classified as safe before invoking \/bin\sh -c. The attacker can therefore execute arbitrary shell commands without being subject to the configured approval allowlist, leading to elevated privileges or unwanted command execution.

All OpenClaw installations running a version earlier than 2026.3.7 on a Node.js runtime are affected. This applies to any deployment that uses the system.run interface or calls into the dispatch wrapper logic.

The CVSS score of 2.1 indicates a low overall risk, and the EPSS score is below 1%, meaning the likelihood of exploitation is low. The vulnerability is not recorded in the CISA KEV catalog. Exploitation requires the attacker to trigger system.run with a specifically crafted sequence of wrappers; local or remote code execution depends on the target system’s exposure and the attacker’s ability to inject such calls. Based on the description, the attack vector is inferred to be a local or remote input that can invoke system.run, but the exact delivery method is not explicitly detailed in the advisory.