OpenClaw's POSIX node system.run safe-bin allowlist can be bypassed due to shell expansion altering command interpretation. This allows a lower-privilege operator to cause an approved safe-bin command to read unintended local files on the node. The issue affects deployments using safe-bin or allowlist auto-approval with shell-expanded arguments on POSIX nodes. It is a policy enforcement gap in argument validation, not a direct unauthenticated takeover. The vulnerability is patched in OpenClaw version 2026.5.18.