Openclaw cli: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed (CVE-2026-32065)

The vulnerability in OpenClaw CLI's system.run approval mechanism arises because the approval identity is based on rendered command text with trimmed argv token whitespace, while the runtime executes the raw argv. An attacker can craft a trailing-space executable token that appears benign in the approval display but executes a different binary at runtime. This approval-integrity bypass can lead to unexpected command execution under the OpenClaw runtime user if the attacker can influence the command arguments and reuse or obtain a matching approval context. The flaw breaks the operator approval boundary, even though OpenClaw does not consider multi-user sharing of a gateway host/config a supported security boundary. The issue is patched in version 2026.2.25.

This vulnerability allows an attacker with the ability to influence command arguments and reuse an approval context to bypass the approval mechanism and execute arbitrary commands under the OpenClaw runtime user. This can lead to unauthorized command execution, potentially compromising the system or its data. The impact is limited by the requirement for the attacker to have some level of influence over command arguments and access to an approval context.

A patch is available and should be applied by upgrading OpenClaw CLI to version 2026.2.25 or later. This update corrects the approval identity calculation to prevent the mismatch between displayed and executed commands. No additional mitigation is required beyond applying the official fix.