Package Instance

OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
`shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios.

OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth
A client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including `operator.admin`) before pairing approval, enabling privilege escalation.

OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch
In `openclaw` versions `2026.2.22` and `2026.2.23`, the optional `synology-chat` channel plugin had an authorization fail-open condition: when `dmPolicy` was `allowlist` and `allowedUserIds` was empty/unset, unauthorized senders were still allowed through to agent dispatch.

This is assessed as **medium** severity because it requires channel/plugin setup and Synology sender access, but can still trigger downstream agent/tool actions.

OpenClaw has a Discord `allowFrom` slug-collision authorization bypass
OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys.

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection
A client authenticated with a shared gateway token could connect as `role=node` without device identity/pairing, then call `node.event` to trigger `agent.request` and `voice.transcript` flows.

OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
`system.run` allowed `SHELLOPTS` + `PS4` environment injection to trigger command substitution during `bash -lc` xtrace expansion before the allowlisted command body executed.

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program
This issue applies to a **non-default configuration** only.
If `sort` is manually added to `tools.exec.safeBins`, OpenClaw could treat `sort --compress-program=<prog>` as valid safe-bin usage.
In `security=allowlist` + `ask=on-miss`, this could satisfy allowlist checks and skip operator approval, while GNU `sort` may invoke an external program via `--compress-program`.

OpenClaw hook transform path containment missed symlink-resolved escapes
When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.

OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
`system.run` exec allowlist analysis treated wrapper binaries as the effective executable and did not fully unwrap `env`/shell-dispatch wrappers.

This allowed wrapper-smuggled payloads (for example `env bash -lc ...`) to satisfy an allowlist entry for the wrapper while executing non-allowlisted commands.

OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
In OpenClaw `system.run` allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as `$\\` + newline + `(` inside double quotes. Analysis treated the payload as allowlisted (for example `/bin/echo`), while shell runtime folded the line continuation into `$(...)` and executed non-allowlisted subcommands.

OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

OpenClaw has a Feishu allowFrom authorization bypass via display-name collision
Feishu allowlist authorization could be bypassed by display-name collision.

OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.

This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
- Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
- Hash outputs are visible to third-party model providers in system prompts.
- No direct plaintext token disclosure.
- Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.

OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
In OpenClaw's macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text.

Because of that gap, payloads like `echo "ok $(id)"` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution.