Summary
OpenClaw versions before 2026.8.1 do not properly bind reusable execution approvals to the working directory where they were granted. An attacker who can obtain or influence an allow-always approval may reuse it in another directory, causing an approved command to operate on unreviewed files or repositories.
Affected context
The vulnerability occurs in OpenClaw deployments that use reusable allow-always approvals for command execution. Risk increases when the same approval can be applied across working directories without verifying that the target directory matches the context reviewed by the approver.
Exploit preconditions
- Attack surface: OpenClaw's reusable command-approval and execution workflow
- Required access: Ability to obtain, trigger, or influence an existing allow-always approval
- Trigger point: Reuse of the approved command from a different working directory
- Why exploitation is possible: Authorization is evaluated without adequately binding the approval to its original directory context
Why this happens
The underlying flaw is an authorization-context mismatch. OpenClaw treats a reusable command approval as valid without sufficiently associating it with the working directory that was reviewed. This maps to CWE-863, Improper Authorization, because the system permits an action outside the scope of the security decision originally granted.
Potential impact
- An attacker may cause approved commands to operate on unintended files.
- Sensitive files or repositories could be modified, deleted, or exposed.
- Unreviewed code or configuration changes could be introduced.
- Repository integrity and development or automation workflows could be disrupted.
- The issue could contribute to broader compromise if commands have elevated privileges.
General mitigation guidance
Mitigation generally focuses on making execution approvals specific to the
complete security-relevant context.
Common defensive patterns include:
- Binding approvals to the working directory, repository identity, and other relevant execution attributes.
- Requiring renewed confirmation when a command is used in a different directory or against different resources.
- Applying default-deny authorization for commands that can modify files or invoke external tools.
- Limiting execution privileges, filesystem access, and repository permissions to the minimum required.
- Avoiding persistent approvals for high-impact operations and reducing the lifetime and scope of reusable decisions.
- Clearly displaying the command, directory, and affected resources before approval.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for approval tokens or policy decisions that omit working-directory context.
- Tests that reuse an approval across directories, repositories, users, or changed resource sets.
- Audit-log correlation between approval creation and subsequent execution context.
- Policy enforcement requiring directory, repository, identity, and privilege attributes in authorization records.
- Automated security review tools that flag authorization checks performed without complete contextual binding.
