CVE-2026-53866

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description An allowlist bypass exists in shell inline-command parsing. A command request using shell inline-command forms can route through a parser case that misses the expected allowlist decision, allowing authenticated operators to execute unapproved shell content without the intended approval prompts.

Recommendations Update to version 2026.5.12. Require approval for shell inline-command forms. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the shell inline-command feature when it is not needed.