OpenClaw before 2026.5.26 contains a flaw that allows authenticated operators to bypass the exec allowlist, enabling them to craft command requests that trigger wrapper‑level side effects outside of the intended command set. This effectively permits execution of unintended operations, exposing the platform to unauthorized command execution. The underlying weakness is catalogued as CWE‑184.

The vulnerability affects all versions of OpenClaw prior to 2026.5.26. Users running an earlier release are susceptible regardless of operating system or deployment environment.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector requires an authenticated operator who can submit crafted command requests to the system. While the risk of exploitation is considered low, the impact is significant if an authenticated user abuses the bypass to run unauthorized commands.