CVE-2026-26325: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26325 is an improper access control vulnerability in OpenClaw, a personal AI assistant, affecting the node host system.run handler. A mismatch between rawCommand and command[] parameters allows allowlist/approval evaluation to be performed on one command while a different argv is actually executed, effectively bypassing security controls. The vulnerability affects all OpenClaw (npm) versions prior to 2026.2.14 and was disclosed on February 15, 2026, with the GitHub Advisory Database publishing it on February 17, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-284 (Improper Access Control): the node host system.run handler accepted a rawCommand string (used for allowlist/approval evaluation) and a separate command[] argv array (used for actual execution) without validating that they were consistent with each other. An attacker with high privileges who can invoke system.run could craft a request supplying an allowlisted rawCommand value (e.g., echo hi) while providing a completely different command[] argv (e.g., ["uname", "-a"]), causing the security policy to approve the benign command while the system executes the malicious one. The fix, introduced in commit cb3290f, adds a validateSystemRunCommandConsistency() function that enforces matching between rawCommand and the formatted argv at both the gateway (fail-fast) and node host layers, rejecting requests with a RAW_COMMAND_MISMATCH error code (GitHub Advisory, Fix Commit).

Successful exploitation allows a high-privileged attacker to execute arbitrary, unapproved system commands on the host running the OpenClaw node, bypassing the allowlist enforcement and approval prompting mechanisms entirely. This results in high impact to confidentiality, integrity, and availability — the attacker can read sensitive data, modify system state, or disrupt availability of the affected node. The scope is limited to deployments using the node host/companion node execution path with security=allowlist and approval prompting (e.g., ask=on-miss) enabled; default and non-node configurations are not affected (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). Exploitation requires high privileges (the ability to invoke system.run) and a specific non-default configuration, significantly limiting the attack surface. The EPSS score is approximately 0.018% (0.035% per GitHub Advisory), placing it in the 11th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a vulnerable target: Confirm the target OpenClaw deployment uses the node host/companion node execution path, has security=allowlist configured, and has approval prompting enabled (e.g., ask=on-miss), running a version prior to 2026.2.14.
2. Obtain high-privilege access: Acquire credentials or a session token with sufficient privileges to invoke system.run on the node (the vulnerability requires operator.write or equivalent access).
3. Craft a mismatched request: Send a node.invoke RPC request targeting system.run with a rawCommand set to an allowlisted, benign command (e.g., echo hi) and a command[] argv set to the desired unauthorized command (e.g., ["uname", "-a"] or a more harmful payload).
4. Bypass allowlist evaluation: The gateway evaluates the allowlist against rawCommand (echo hi), which passes. The node host then executes the command[] argv (the unauthorized command) without re-validating consistency.
5. Achieve arbitrary command execution: The unauthorized command runs on the host system under the OpenClaw node process's privileges, enabling data exfiltration, system reconnaissance, or further compromise (GitHub Advisory, Fix Commit).

• Logs: OpenClaw gateway or node host logs showing node.invoke calls to system.run where rawCommand and command[] differ; look for commands executed that do not match the displayed/approved command text in audit logs.
• Process: Unexpected child processes spawned by the OpenClaw node host process that do not correspond to allowlisted commands (e.g., uname, id, curl, wget, or shell interpreters invoked with unusual arguments).
• Network: Outbound network connections from the OpenClaw node host to unexpected external IPs or internal services, potentially indicating post-exploitation data exfiltration or lateral movement.
• Application: After patching to 2026.2.14, any INVALID_REQUEST: rawCommand does not match command errors in logs may indicate attempted exploitation of this vulnerability against the patched system (Fix Commit).

Upgrade OpenClaw (npm package) to version 2026.2.14 or later, which enforces rawCommand/command[] consistency via gateway fail-fast validation and node host re-validation (GitHub Advisory, Release Notes). For deployments that cannot immediately patch, restrict access to system.run to only the most trusted high-privilege users, and consider disabling the node host execution path or allowlist-based exec policy until patching is complete. Default/non-node configurations are not affected and require no action.

The vulnerability was reported by security researcher @christos-eth and disclosed responsibly through the OpenClaw GitHub security advisory process (GitHub Advisory). The release of version 2026.2.14 addressed over 60 security vulnerabilities simultaneously, which was noted in security digest coverage (BeyondMachines). No significant broader media coverage or notable social media reactions specific to this CVE have been identified.