OpenClaw versions prior to 2026.5.18 have a vulnerability in the exec approval UI where very long commands are truncated in the display, potentially hiding the full command from the approver. This truncation can cause an approver to unknowingly approve a command with a hidden suffix that executes additional operations. The issue affects deployments with exec approval enabled and requires both an authenticated requester and an approver. The vulnerability compromises approval integrity but does not expose exec functionality to unauthenticated users or alter the local-first trust model. A fix is available in version 2026.5.18.