OpenClaw CVE-2026-100561

Two concrete prerequisites must both hold: (1) the trusted command-running wrapper (a transparent shell carrier, or an opaque utility such as a process monitor, tracer, namespace tool, or proxy wrapper) must resolve/exist on the host, and (2) an operator must have previously allowlisted or permanently approved that specific wrapper invocation in the exec approval policy. Given those, a later agent turn can substitute an arbitrary inner command in the wrapper's arguments and execute it without a new approval prompt. Limiting factors: exploitation is not possible against a default fresh configuration with no prior approvals, and it depends on an attacker being able to influence a subsequent agent turn (e.g. via prompt injection or a malicious task); the flaw is fully remediated in version 2026.8.1.

This is a genuine high-priority integrity/availability/confidentiality risk within its niche, though gated by operator behavior. The vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P/VC:H/VI:H/VA:H, 8.6) captures full host-level technical impact - arbitrary command execution at the OpenClaw process's privileges - reachable over the network by a low-privileged agent turn. However, the raw score understates real-world friction: exploitation is not a clean AC:L/UI:N path because it requires two specific preconditions (the wrapper must resolve on the host AND an operator must have previously allowlisted or permanently approved that wrapper invocation). No EPSS score, no CISA KEV listing, and no public POC are provided, so all exploitation signals point to no confirmed or automated exploitation at this time. My independent 3.1 assessment (~8.0, AV:N/AC:H/PR:L) treats those preconditions as elevated attack complexity rather than trivial access - this is a real defect worth patching promptly for OpenClaw operators, but the deployment footprint is small and there is no evidence of active exploitation, so it is not a mass-scan emergency. CWE-88 (argument injection) is the accurate root cause; the 'Authentication Bypass' tag mischaracterizes it as an authorization/authn issue.

An operator, trusting a benign wrapper (e.g. a shell carrier, process monitor, tracer, or proxy utility), allowlists or permanently approves it so the AI agent can run it without repeated prompts. On a later turn the agent - steered by a malicious prompt, poisoned context, or a compromised task - reuses that approved wrapper but swaps in an arbitrary inner command carried in its arguments, which executes with the OpenClaw process's host privileges and no fresh approval prompt. No public exploit code is identified at time of analysis.