CVE-2026-53861

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description The macOS Swift exec feature contains an allowlist bypass. The issue occurs because the system fails to account for combined POSIX inline-command flags, which are shorthand ways of grouping multiple command-line options together. This allows attackers to execute shell content that bypasses the intended allowlist checks, potentially leading to unauthorized command execution depending on the operator configuration.

Recommendations Update to version 2026.5.6. Require approval for combined shell flag forms on macOS. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the macOS Swift exec feature when it is not needed.