Compliance Impact

The vulnerability allows authenticated operators to exploit shell metacharacters to read unintended node-local files and expose sensitive configuration data. This exposure of sensitive data could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on access to and protection of sensitive information.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.18 and involves a flaw in the policy enforcement of the system.run safe-bin allowlist validation. Specifically, it allows shell expansion to alter how commands are interpreted on POSIX nodes.

Authenticated operators can exploit this by using shell metacharacters within approved commands, which enables them to read unintended local files on the node and potentially expose sensitive configuration data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive configuration data by allowing authenticated users to bypass intended command restrictions.

This exposure of sensitive local files could compromise system security, potentially leading to further exploitation or unauthorized access.

Useful 0 Not Useful 0