OpenClaw software contains a flaw that lets an attacker influence the agentic consent mechanism through a configuration patch. The flaw permits LLM agents to disable the execution approval prompt without the user’s knowledge, enabling the attacker to run unvetted commands or operations. This results in the attacker achieving unintended code or privilege execution, compromising confidentiality, integrity, and availability of the running system.

OpenClaw OpenClaw, versions prior to 2026.3.28. Any deployment using an older release of OpenClaw that processes agent configuration patches is affected.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently very low, and it is not included in the CISA KEV catalog. Nevertheless, the flaw can be leveraged over the network by a remote attacker, as the configuration patch can be delivered remotely to a compromised or compromised agent. Attackers could therefore bypass normal consent checks and execute unauthorized actions, potentially escalating privileges or disseminating malware. The lack of a documented workaround means mitigation relies on applying the vendor’s patch or enforcing additional access controls.