CVE-2026-26325

Deeper analysis

CVE-2026-26325 affects OpenClaw, a personal AI assistant, in versions prior to 2026.2.14. The vulnerability stems from a mismatch between the `rawCommand` and `command[]` parameters in the node host `system.run` handler, which causes allowlist or approval evaluation to be performed on one command while a different argument vector (argv) is executed. This issue is limited to deployments using the node host or companion node execution path for `system.run`, with allowlist-based execution policy enabled (`security=allowlist`) and approval prompting on allowlist misses (e.g., `ask=on-miss`). Default and non-node configurations are unaffected. The vulnerability is classified under CWE-284 (Improper Access Control) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

An attacker requires high privileges (PR:H) to exploit this vulnerability over the network with low complexity and no user interaction. In affected configurations, a privileged adversary who can invoke `system.run` could supply a benign `rawCommand` that passes allowlist checks or approval prompts, while providing a malicious `command[]` argv that executes arbitrary code. This bypasses security controls, potentially granting high-impact unauthorized access to confidentiality, integrity, and availability on the host system.

The OpenClaw security advisory (GHSA-h3f9-mjwj-w476), release notes for v2026.2.14, and fixing commit (cb3290fca32593956638f161d9776266b90ab891) recommend upgrading to version 2026.2.14, which enforces consistency between `rawCommand` and `command[]` through gateway fail-fast checks and node host validation. No additional workarounds are specified for prior versions.