Summary
OpenClaw Windows Node before 2026.7.1 contains an authorization flaw in the
system.run execution-approval policy. A connected gateway or agent may bypass
command approval rules by hiding denied commands behind permitted prefixes,
potentially resulting in arbitrary command execution on the Windows host.
Affected context
The vulnerability occurs in OpenClaw Windows Node deployments that use the
system.run execution-approval workflow and rely on
ExecShellWrapperParser to identify command boundaries. Risk is present when
a connected gateway or agent can submit commands for approval and the parser
does not fully recognize pipe operators or command-substitution constructs.
Exploit preconditions
- Attack surface: The
system.runcommand-execution interface - Required access: Connectivity and authorization to submit commands through
a gateway or agent
- Trigger point: Execution-approval evaluation before a command runs on a
Windows host
- Why exploitation is possible: The approval parser may treat a compound
command as matching an allowed prefix without independently evaluating all
commands or substitutions it contains
Why this happens
The root cause is an authorization decision based on incomplete command parsing.
ExecShellWrapperParser does not consistently split commands at pipe operators
or identify command substitutions, allowing policy evaluation to cover only part
of the requested execution. This maps to CWE-863: Incorrect Authorization,
because a security control grants execution based on an incomplete interpretation
of the requested operation.
Potential impact
- An attacker may execute commands that should have been denied
- The Windows host could be compromised
- Sensitive files or credentials may be accessed
- The attacker could alter data, configurations, or installed software
- Connected systems could be used for lateral movement or further compromise
General mitigation guidance
Mitigation generally focuses on making authorization decisions over a complete,
normalized representation of the requested command rather than relying on
prefix-based checks.
Defensive patterns include:
- Using a command parser that recognizes all supported shell operators and
substitution forms
- Applying allowlists to structured executable and argument representations
instead of raw command prefixes
- Rejecting ambiguous, compound, or unsupported command syntax by default
- Separating command approval from shell interpretation where possible
- Running the Windows node with least privilege and limiting access available
to connected gateways and agents
- Treating gateway and agent command requests as untrusted until independently
authorized
How teams detect issues like this
Detection approaches may include:
- Static analysis and code review for prefix-based authorization checks,
incomplete shell tokenization, and parser/evaluator mismatches
- Tests covering pipes, substitutions, chaining, quoting, escaping, and nested
command structures
- Policy checks that require complete command normalization before approval
- Runtime logging of submitted commands, authorization decisions, and the
resulting execution context
- Monitoring for denied-command patterns embedded within otherwise permitted
requests
Automated security review tools may help identify discrepancies between command
parsing and authorization logic, but behavioral tests remain important for
shell-related policy controls.
