On POSIX nodes, OpenClaw's system.run safe-bin checks approve commands before shell expansion, which can change how commands are interpreted by expanding arguments into additional shell words. This can cause a safe-bin approved command to read node-local files not intended by policy. The vulnerability is limited to paired POSIX nodes where system.run is accessible to authenticated operators or agents, and where exec policy uses safe-bin or allowlist auto-approval. This is a policy enforcement gap in argv validation rather than a general safe-bin command safety issue. The first stable patched version is 2026.5.18.

A lower-privilege operator flow can exploit this vulnerability to cause an approved safe-bin command to read local files on the node that were not intended to be accessible. This can lead to exposure of OpenClaw configuration data or other sensitive node-local information. The impact is confidentiality loss of local files due to insufficient validation of shell-expanded command arguments.

Upgrade OpenClaw to version 2026.5.18 or later, where this issue is patched. Until upgrading, avoid broad safe-bin auto-approval for commands that can read arbitrary paths. Prefer explicit approval for node commands that access local files to reduce risk.