OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution
Published Mar 19, 2026 · Updated Oct 23, 2026 · Also known as GHSA-6j27-pc5c-m8w8
Original summary
Normalized public record · Updated Oct 23, 2026
OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
In openclaw npm releases up to and including 2026.2.21-2, approving wrapped system.run commands with allow-always in security=allowlist mode could persist wrapper-level allowlist entries and enable later approval-bypass execution of different inner payloads.
Potential impact
Authorization boundary bypass in allowlist mode, potentially leading to approval-free command execution (RCE class) on subsequent wrapped invocations.
Technical context
allow-always persistence was based on wrapper-level resolution instead of stable inner executable intent. A benign approved wrapper invocation could therefore broaden future trust boundaries. Affected paths included gateway and node-host execution approval persistence flows. The fix now persists inner executable paths for known dispatch-wrapper chains (env, nice, nohup, stdbuf, timeout) and fails closed when safe unwrapping cannot be derived.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- GHSA-6j27-pc5c-m8w8
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- Patch commit ↗
- VulnCheck Advisory: OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence ↗
Record history
Published Mar 19, 2026 · Last refreshed Oct 23, 2026