CVE-2026-27183: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-27183 is a shell approval gating bypass vulnerability in OpenClaw's system.run dispatch-wrapper handling, classified as Incorrect Authorization (CWE-863) and Interpretation Conflict (CWE-436). It affects all OpenClaw npm package versions prior to 2026.3.7 (specifically <= 2026.3.2). The vulnerability was reported by researcher @tdjackey, fixed on the main branch on March 7, 2026, and publicly disclosed via a GitHub Security Advisory on March 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, VulnCheck).

The root cause is a depth-boundary mismatch between two internal components: the approval classifier (hasEnvManipulationBeforeShellWrapperInternal) and the execution planner (extractShellWrapperCommandInternal). Both functions used a depth >= MAX_DISPATCH_WRAPPER_DEPTH boundary check, which caused the classifier to stop treating a command as a shell wrapper exactly at the boundary depth, while the execution planner continued unwrapping through to the shell payload. By crafting a command with exactly four transparent dispatch wrappers — such as repeated /usr/bin/env invocations — before /bin/sh -c <payload>, an attacker could cause the classifier to miss the shell wrapper at the boundary depth, bypassing the security=allowlist approval gate while execution still proceeded. The fix changed both checks from >= to >, ensuring the wrapper found at the boundary depth still participates in approval classification (GitHub Advisory, Fix Commit).

Successful exploitation allows a low-privileged local attacker to execute arbitrary shell commands that would otherwise require explicit user approval under the security=allowlist mode, bypassing the intended authorization gate. The impact is assessed as low across confidentiality, integrity, and availability — the attacker can read limited data, modify limited data, or cause limited disruption within the scope of the OpenClaw process. Critically, this undermines the trust model of the allowlist security feature, potentially enabling unauthorized command execution that users believe is protected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.011% (0.000110), indicating very low probability of exploitation in the near term. The vulnerability requires local access and the target system must be running OpenClaw in security=allowlist mode, which limits the attack surface. No threat actor attribution or CISA KEV catalog listing has been identified (GitHub Advisory, VulnCheck).

1. Identify target: Confirm the target system is running OpenClaw (npm) version <= 2026.3.2 with security=allowlist mode enabled, which is the prerequisite for the approval gating to be in effect.
2. Craft the dispatch-wrapper chain: Construct a system.run invocation using exactly four transparent dispatch wrappers before the shell invocation — for example: ["/usr/bin/env", "/usr/bin/env", "/usr/bin/env", "/usr/bin/env", "/bin/sh", "-c", "<payload>"].
3. Trigger the boundary mismatch: Submit the crafted command through the system.run interface. The approval classifier stops classifying the command as a shell wrapper at depth 4 (the boundary), while the execution planner continues unwrapping and reaches /bin/sh -c.
4. Bypass approval gate: Because the classifier does not flag the command as requiring shell-wrapper approval, the security=allowlist gate is not triggered, and the shell payload executes without prompting for user approval (GitHub Advisory, Fix Commit).

• Logs: OpenClaw execution logs showing system.run invocations with four or more consecutive /usr/bin/env entries in the argument array immediately preceding /bin/sh -c or similar shell invocations, without a corresponding approval-required event.
• Process: Unexpected child processes spawned via /bin/sh -c from the OpenClaw Node.js process without a preceding approval dialog or log entry indicating user consent.
• File System: Unexpected files created or modified by the OpenClaw process in locations not consistent with normal workflow activity (e.g., test artifacts like depth4-pwned.txt as referenced in the fix's test suite) (Fix Commit).

Upgrade OpenClaw (npm) to version 2026.3.7 or later, which was published on March 8, 2026 and contains the fix aligning the approval classifier and execution planner depth-boundary checks. No configuration-based workaround is available; the only effective remediation is upgrading to the patched version. As a defense-in-depth measure, apply the principle of least privilege to restrict local user access and monitor execution logs for unusual dispatch-wrapper chains (GitHub Advisory, Fix Commit).