CVE-2026-31993: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-31993 is an allowlist parsing mismatch vulnerability in the OpenClaw macOS companion app (beta) that allows authenticated operators to bypass exec approval checks and execute arbitrary commands on paired macOS hosts. It affects OpenClaw (npm) versions up to and including 2026.2.21-2, and is patched in version 2026.2.22. The vulnerability was disclosed on March 19, 2026, with fixes committed the same day. It carries a CVSS v3.1 base score of 6.4 (Medium) and a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Feedly).

The root cause is an incomplete allowlist validation mechanism (CWE-184: Incomplete List of Disallowed Inputs) combined with improper authorization (CWE-285) in the system.run exec approval path of the OpenClaw macOS companion app. When tools.exec.host is enabled with security=allowlist and ask=on-miss, the original code resolved only the first token of a shell-chain command (e.g., sh -c 'allowed_cmd && malicious_cmd') against the allowlist, failing to evaluate subsequent chained segments. An attacker with operator.write privileges and a paired macOS beta node could craft a shell-chain payload where the first command passes the allowlist check while subsequent commands — separated by &&, ||, ;, |, or backtick substitution — execute arbitrary code without approval. The fix introduces per-segment resolution via resolveForAllowlist(), which splits shell chains and fails closed on unsafe shell-substitution constructs (GitHub Advisory, Fix Commit 1, Fix Commit 2).

Successful exploitation allows an authenticated operator to execute arbitrary shell commands on the paired macOS host, resulting in high integrity and confidentiality impact and low availability impact. Because the commands run in the context of the OpenClaw companion app process, an attacker could read sensitive files, modify system state, install persistence mechanisms, or pivot to other systems accessible from the macOS host. Default OpenClaw installations are not affected — exploitation requires tools.exec.host to be explicitly enabled with allowlist mode configured (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.049% (0.000490), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a high-privilege authenticated account (operator.write), a paired macOS beta node, and a non-default configuration, significantly limiting the attack surface (GitHub Advisory).

1. Identify target: Locate an OpenClaw deployment running a version prior to 2026.2.22 with the macOS companion app (beta) paired and tools.exec.host enabled with security=allowlist and ask=on-miss.
2. Obtain operator credentials: Acquire or compromise an account with operator.write privileges on the target OpenClaw instance.
3. Craft shell-chain payload: Construct a system.run command using a shell wrapper (e.g., sh -c '<allowlisted_cmd> && <malicious_cmd>') where the first segment matches an allowlisted entry but subsequent segments contain arbitrary commands.
4. Submit payload: Send the crafted shell-chain command via the OpenClaw operator API. The incomplete allowlist validation evaluates only the first token (<allowlisted_cmd>), approving the entire chain.
5. Achieve arbitrary execution: The chained malicious command executes on the paired macOS host in the context of the OpenClaw companion app process, enabling data exfiltration, persistence installation, or further lateral movement (GitHub Advisory, Fix Commit 1).

• Logs: OpenClaw exec approval logs showing system.run invocations with shell-chain payloads (e.g., commands containing &&, ||, ;, |, or backtick sequences) that were approved without an explicit user prompt; allowlist use records referencing only the first segment of a multi-command chain.
• Process: Unexpected child processes spawned by the OpenClaw macOS companion app process (e.g., /bin/sh, /bin/bash, /bin/zsh) executing commands beyond the allowlisted binary, particularly network tools (curl, wget, nc) or scripting interpreters.
• File System: New files, scripts, cron jobs, or LaunchAgent/LaunchDaemon plists created by the OpenClaw process owner in user or system directories.
• Network: Outbound connections from the macOS host to unexpected external IPs or domains initiated by processes spawned from the OpenClaw companion app.

Upgrade OpenClaw (npm) to version 2026.2.22 or later, which hardens system.run allowlist handling by evaluating shell chains per segment and failing closed on unsafe shell-substitution constructs (GitHub Advisory). As interim workarounds: restrict operator.write privileges to fully trusted users only; avoid enabling tools.exec.host with security=allowlist on macOS beta nodes in production environments; and implement network segmentation to limit access to paired macOS nodes. Monitor OpenClaw instances for suspicious shell-chain command activity in exec approval logs (Feedly).

The vulnerability was reported by researcher @tdjackey and acknowledged in the official GitHub Security Advisory published by maintainer steipete (GitHub Advisory). The advisory was rated "Low" severity by the OpenClaw project, reflecting the significant preconditions required for exploitation. No notable broader media coverage or social media discussion has been identified beyond standard vulnerability aggregator indexing.