Summary
OpenClaw versions before 2026.8.1 may incorrectly persist an "Allow Always" approval for an exact command as a grant tied only to its executable path. An attacker who can invoke that executable may supply different arguments to run commands without receiving a new approval prompt, potentially accessing local files or internal services.
Affected context
The issue occurs in OpenClaw deployments on macOS or Linux where command approvals use persistent "Allow Always" decisions. The risk is present when an approval intended for one exact command is represented or enforced as a broader path-only permission, allowing later invocations of the same executable to bypass renewed authorization.
Exploit preconditions
- Attack surface: OpenClaw command execution and approval handling - Required access: The ability to cause OpenClaw to invoke an approved
executable, directly or through an exposed workflow
- Trigger point: Reuse of the executable with arguments different from those
covered by the original approval
- Why exploitation is possible: The authorization decision is scoped to the
executable path rather than the complete command and argument set
Why this happens
The underlying flaw is an authorization-scope mismatch. An approval granted for an exact command is persisted and later evaluated as a permission for the executable path alone, so materially different arguments are not independently authorized. This behavior maps to CWE-863, Incorrect Authorization, because the system fails to enforce the intended permission boundary for subsequent command executions.
Potential impact
- An attacker may execute commands with arguments that were never approved.
- Sensitive local files could be accessed or modified.
- Internal services reachable from the host may be queried or affected.
- Application or user data could be altered through unauthorized operations.
- The host environment could be exposed to broader command-execution abuse.
General mitigation guidance
Mitigation generally focuses on preserving the narrowest intended scope for every approval decision. Authorization records should bind approvals to the executable, normalized arguments, relevant working context, and other security-sensitive execution attributes where appropriate. Secure-by-default behavior should require renewed approval when command semantics change, while reducing trust in mutable or user-controlled command inputs. Execution should use least-privilege accounts, restricted filesystem and network permissions, and narrowly scoped access to internal services. Approval state should also be protected from unauthorized modification and invalidated when its context changes.
How teams detect issues like this
Detection can include static analysis and code review for permission checks that compare executable paths without validating arguments or execution context. Reviewers can look for persistent approval records, path-prefix matching, weak command normalization, and authorization decisions made before complete command construction. Runtime monitoring can flag commands executed under persistent approvals when their arguments differ from the approved invocation. Policy enforcement may require explicit approval for each distinct command shape, and automated security review tools can help identify overly broad authorization scopes.
