CVE-2026-27566: OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-19 · updated 2026-06-17
Weakness: CWE-78

Description

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while executing non-allowlisted commands.

Affected products

OpenClaw: before 2026.2.22 — fixed in 2026.2.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.22. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/2b63592be57782c8946e521bc81286933f0f99c7
https://github.com/openclaw/openclaw/security/advisories/GHSA-jj82-76v6-933r
https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-wrapper-binary-unwrapping-in-system-run

Get alerted when CVE-2026-27566 or the next vulnerability affects your stack