Openclaw cli: OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals (CVE-2026-26325)

The vulnerability arises from a mismatch between the rawCommand string and the command[] argument vector in the node host system.run handler of openclaw-cli. This mismatch causes the allowlist and approval evaluation to be performed on the rawCommand while the node executes a different command[], enabling an attacker to bypass allowlist enforcement and approval prompts. This affects configurations that use the node host execution path with allowlist-based exec policies and approval prompting on misses. The vulnerability is present in openclaw versions >=2026.1.29 and <2026.2.14. The fix involves enforcing consistency between rawCommand and command[] via gateway fail-fast and node host validation, planned for release in version 2026.2.14.

An attacker who can invoke system.run on affected openclaw-cli deployments can bypass allowlist enforcement and approval prompts by supplying a rawCommand that passes allowlist checks while executing a different command[]. This results in unauthorized command execution, potentially leading to full compromise of the node host system with high confidentiality, integrity, and availability impact.

A patch is available and planned for openclaw-cli version 2026.2.14 that enforces consistency between rawCommand and command[]. Users should upgrade to version 2026.2.14 or later once released. Until then, affected configurations that enable node host system.run with allowlist-based exec policies and approval prompting should consider restricting access to system.run or disabling allowlist enforcement if feasible. Monitor the official openclaw advisory for the release of the patch.