OpenClaw Directory Context Bypass in Command Execution

Executive Summary

OpenClaw versions before 2026.8.1 fail to bind the working directory context to reusable exec approvals. This allows approved commands to execute in different directories than originally intended. Attackers with an always-approved command can reuse it to run the same command against unreviewed files or repositories, potentially causing unintended or harmful effects.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking OpenClaw versions and reviewing exec approvals. First, verify the installed version with 'openclaw --version' or similar command. If the version is before 2026.8.1, the system is vulnerable. Next, inspect exec approvals for commands that lack directory binding by reviewing configuration files or logs where approvals are stored.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute approved commands in unintended directories, potentially affecting files or repositories the operator did not intend to approve. This could lead to unauthorized read or write operations, depending on the command and the new directory's contents.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data by allowing approved commands to execute in unintended directories. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized data access or changes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenClaw to version 2026.8.1 or later. Avoid using reusable exec approvals for commands sensitive to working directories. Review and remove any existing standing approvals that could be exploited. Monitor for unauthorized command executions in different directories.

Useful 0 Not Useful 0