OpenClaw CVE-2026-100552

Requires a specific deployment: a lower-trust conversation assigned to a Codex app-server runtime AND restricted with a per-chat tools.allow allowlist (the operator relies on this allowlist as the trust boundary). The attacker must be a participant able to trigger that agent (PR:L, authenticated/low-trust access per the CVSS vector), so it is not remote-unauthenticated. The bypass only reaches native shell/process/file/patch tools owned by the Codex runtime - OpenClaw's own tools are correctly filtered. The severity of the outcome is further limited by the Codex runtime's host permissions and sandbox configuration: a tightly sandboxed, low-privilege runtime sharply reduces impact, while an unsandboxed host-privileged runtime enables full command and file access. Fixed in OpenClaw 2026.8.1.

The vendor (VulnCheck) CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H (8.7) rates this High, and the mechanism supports a serious rating: a per-chat tools.allow allowlist that operators rely on to sandbox a low-trust conversation is silently ineffective against the Codex runtime's native shell/process/file/patch tools, so the security control fails open. The realistic impact, however, is explicitly conditional - the description states practical impact 'depends on the runtime's host permissions and sandbox configuration,' so VC/VI/VA:H represents the worst case (an unsandboxed, host-privileged Codex runtime) rather than a guaranteed outcome. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so all exploitation signals are absent; risk is driven by severity-of-outcome, not by observed exploitation. This is a real priority for anyone actually running Codex runtimes with per-chat allowlists as a trust boundary (the control they depend on does not work), but it is a niche open-source AI-agent framework with a small deployment footprint, and exploitation still requires a pre-existing multi-participant/low-trust configuration plus a permissive host sandbox. Note the CWE (CWE-863 improper authorization) conflicts with the input 'Authentication Bypass' tag - this is an authorization/policy-enforcement gap, not authentication bypass; verify labeling.

An operator assigns a lower-trust chat to a Codex app-server runtime and restricts it with a per-chat tools.allow allowlist, believing native shell and file access is blocked. A participant able to trigger that agent instructs it to use the Codex runtime's shell/process/file/patch tools, which the allowlist never filtered, and reads or modifies host files or runs commands to the extent the runtime's sandbox and host permissions allow. No public proof-of-concept is known at time of analysis.