OpenClaw versions before 2026.2.14 permit an arbitrary file read due to a flaw in the exec-approvals allowlist. The validation step checks each argument before shell expansion, but the subsequent execution performs a real shell expansion, allowing attackers to use glob patterns or environment variables with safe binaries such as head, tail, or grep to read files accessible to the gateway or Node.js process. This flaw is an example of CWE‑78, which represents a command injection or privilege escalation via uncontrolled use of system shell features.

Affected systems include any deployment of OpenClaw running a version older than 2026.2.14. The vulnerability is present in all iterations of OpenClaw prior to the 2026.2.14 release, regardless of platform, as the bug originates in the generic exec‑approval mechanism that applies globally.

The CVSS base score of 8.6 classifies this issue as high severity. The EPSS score indicates an exploitation probability of less than 1%, and the vulnerability is not yet listed in CISA's KEV catalog. The attack vector likely requires either elevated privileges that allow execution of safe binaries or an attacker capable of executing prompt‑injection attacks to trigger shell expansion, thereby exposing non‑secret files that the gateway or Node.js process can read.