CVE-2026-53806: OpenClaw: Combined POSIX shell options could confuse exec revalidation

OpenClaw checks a command against an allowlist, then revalidates it before running. With combined short flags, the two parses of the shell options disagree. The weakness class is time-of-check versus time-of-use (CWE-367). The outcome is that inline shell content, the script passed to the shell, runs without the allowlist decision that should have covered it.

The advisory names no specific flag combination and the sources give no more detail on the parser difference. It says practical impact depends on the operator's configuration and on whether lower-trust input can reach the exec path. It also keeps OpenClaw's trusted-operator model: authenticated Gateway operators and installed plugins stay trusted.

The risk is a Gateway with an exec allowlist, such as a permitted shell, where an agent or a channel user lower in trust can submit command requests. A prompt-injected agent could use the flaw to run arbitrary shell content through an allowlisted shell. The score is 8.8 under CVSS 3.1: network, low privileges, no interaction.

Affected: npm package openclaw 2026.5.7 and earlier, where the exec feature with an allowlist is enabled and reachable by users or agents who are not fully trusted.

npm ls openclaw

Review your exec allowlist for shell entries that accept options such as combined flag forms.

Upgrade to openclaw 2026.5.12 or later, the first stable patched version.

npm install -g [email protected]

Until then, the advisory says to avoid combined shell option forms in allowlisted commands. It also advises keeping channel and tool allowlists narrow, not sharing one Gateway between mutually untrusted users, and disabling exec when it is not needed.

Review exec logs for allowlisted shell commands that use combined option forms, and compare the approved command text with what actually ran. Look for shell processes started by the Gateway with inline script arguments you did not expect. The advisory publishes no log strings, so this is a review of your own records.

Summary

Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could run inline shell content without the intended allowlist decision. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.12.

Mitigations

avoid combined shell option forms in allowlisted commands until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.