OpenClaw Approval Integrity Vulnerability Allowing Unintended Code Execution

A vulnerability in OpenClaw versions prior to 2026.3.11 allows for approval integrity bypass in the node-host 'system.run' approval mode. This vulnerability enables attackers to execute modified local scripts by changing them between the approval and execution stages, particularly when an exact file binding cannot be established. As a result, unintended code execution occurs under the OpenClaw runtime user.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of local code, potentially allowing an attacker to perform actions or access resources as the OpenClaw runtime user.

Remediation

Users are advised to upgrade to OpenClaw version 2026.3.11 or later.