Openclaw cli: OpenClaw: system.run wrapper-depth boundary could skip shell approval gating (CVE-2026-27183)

OpenClaw's system.run dispatch-wrapper handling applied different depth-boundary rules to shell-wrapper approval detection and execution planning. When exactly four transparent dispatch wrappers (e.g., repeated env invocations) precede /bin/sh -c, the approval classifier could stop treating the command as a shell wrapper at the depth boundary, while execution planning still unwrapped to the shell payload. In security=allowlist mode, this discrepancy could bypass the approval-required path for shell wrapper invocation. The vulnerability is fixed in version 2026.3.7 by maintaining shell-wrapper classification active at the dispatch depth boundary and failing closed beyond it, ensuring approval gating aligns with execution planning.

In security=allowlist mode, the vulnerability allows bypassing the expected approval gating for shell wrapper invocations when the command includes exactly four transparent dispatch wrappers before the shell payload. This could lead to unauthorized shell command execution with the privileges of the process running OpenClaw CLI. The CVSS score is 5.3 (medium severity) reflecting local attack vector with low complexity and privileges required, impacting confidentiality, integrity, and availability to a limited extent.

A patch is available and should be applied. Upgrade OpenClaw CLI to version 2026.3.7 or later, which fixes the issue by aligning shell-wrapper approval gating with execution planning at the configured dispatch depth boundary. No additional mitigation actions are required beyond applying the official fix.