Openclaw cli: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution (CVE-2026-29607)

In openclaw npm releases up to and including 2026.2.21-2, the allow-always wrapper persistence mechanism in security=allowlist mode incorrectly persists wrapper-level allowlist entries rather than stable inner executable intent. This allows a benign approved wrapper invocation to broaden trust boundaries and bypass future command approvals, enabling approval-free execution of different inner payloads. The vulnerability affects gateway and node-host execution approval persistence flows. The fix in version 2026.2.22 changes persistence to track inner executable paths for known dispatch-wrapper chains and fails closed when safe unwrapping is not possible.

This vulnerability allows an authorization boundary bypass in allowlist mode, potentially enabling remote code execution without additional approvals on subsequent wrapped command invocations. This could lead to unauthorized command execution with the privileges of the affected system.

Upgrade to openclaw version 2026.2.22 once released to apply the official fix. Until then, run openclaw with stricter execution policies such as ask=always or security=deny to prevent approval bypass.