Openclaw cli: OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode (CVE-2026-32023)

The vulnerability in OpenClaw CLI arises from a wrapper-depth parsing mismatch in the system.run allowlist mode. Specifically, dispatch-wrapper unwrapping stops at a maximum depth, but shell-wrapper extraction may return a non-wrapper once this depth is reached. Meanwhile, allowlist resolution can still succeed on partially unwrapped arguments beginning with /usr/bin/env. This allows nested wrapper chains to execute shell commands without triggering the expected approval prompt under security=allowlist and ask=on-miss settings. The issue affects versions >=2026.1.29 and <2026.2.24 and is fixed in 2026.2.24 with a patch that adds regression coverage and enforces approval denial when appropriate.

This vulnerability allows bypassing the shell-wrapper approval gating mechanism in OpenClaw CLI's system.run allowlist mode, potentially enabling execution of shell commands without operator approval. Given OpenClaw's trust model where authenticated callers are trusted but exec approvals act as guardrails, this represents a significant approval-boundary bypass. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

A fix is available in OpenClaw CLI version 2026.2.24. Users should upgrade to this version or later to remediate the vulnerability. The patch includes a fix for the dispatch-wrapper depth parsing mismatch and enforces approval prompts correctly. No additional mitigation actions are required beyond applying the official update.