Search: CVE-2026-53836

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 have a vulnerability where PowerShell encoded-command aliases may bypass execution allowlist checks. This allows encoded PowerShell commands to run without proper allowlist validation if abbreviated alias forms are used. The vulnerability affects configurations where the feature is enabled and reachable, potentially allowing execution of unauthorized encoded PowerShell content. The issue does not alter the trusted-operator model of OpenClaw. A patch is available starting with version 2026.5.12. Until patched, it is recommended to avoid allowlisting PowerShell wrapper forms and require approval for encoded commands. Additional mitigations include narrowing allowlists, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.