Executive Summary

This vulnerability exists in OpenClaw, a personal AI assistant, prior to version 2026.2.14. It involves a mismatch between the rawCommand and command[] parameters in the node host system.run handler. This mismatch can cause the allowlist or approval evaluation to be performed on one command, while a different command is actually executed. This issue only affects deployments that use the node host or companion node execution path (system.run on a node), have allowlist-based execution policies enabled (security=allowlist), and use approval prompting triggered by allowlist misses (such as ask=on-miss). Default or non-node configurations are not affected.

Version 2026.2.14 fixes this vulnerability by enforcing consistency between rawCommand and command[] through gateway fail-fast and node host validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who is able to invoke system.run on a node to bypass the intended allowlist or approval checks. Because the evaluation is done on one command but a different command is executed, unauthorized commands could be run with potentially high privileges.

The CVSS v3.1 base score of 7.2 indicates a high severity, with impacts on confidentiality, integrity, and availability. This means the attacker could execute commands that compromise sensitive data, alter system behavior, or disrupt services.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenClaw to version 2026.2.14 or later, which enforces consistency between rawCommand and command[] through gateway fail-fast and node host validation.

Additionally, ensure that your deployment does not use the node host / companion node execution path with allowlist-based exec policy and approval prompting driven by allowlist misses, or disable the allowlist-based exec policy if possible.

Useful 0 Not Useful 0