CVE-2026-53848

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.26

Description An exec allowlist bypass exists where authenticated operators can execute wrapper-level side effects outside the intended allowlisted command. This occurs because a command request reaching the exec allowlist path may be evaluated against the inner command while the wrapper invocation is still executed. This allows attackers to craft requests that leverage transparent command wrappers to perform unintended operations.

Recommendations Update to version 2026.5.26. Review wrapper commands carefully and require approval for shell-like wrapper usage. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.