OpenClaw Windows Node CVE-2026-101882

Exploitation requires an active connection to the OpenClaw Windows Node gateway/agent interface reachable over the network (PR:L - the caller must already hold a gateway/agent session, which a prompt-injected agent satisfies). The attacker then calls the system.execApprovals.set capability with an allow rule whose executable (first whitespace-delimited token) contains a wildcard ('*' or '?'), e.g. '*.*', '*.exe', '*e*', or 'c*', which the pre-2026.7.1 ValidateExecApprovalRules fails to reject because it only blocked pure-wildcard/shell-blanket shapes. Once the broad rule is accepted, system.run executes arbitrary commands - including abusable LOLBins mshta, rundll32, certutil - with no operator check or user prompt. Affected: OpenClaw Windows Node before 2026.7.1 on Windows; the fix (v2026.7.1) rejects any allow pattern with a wildcarded executable token. The primary limiting factor is the need for a connected gateway/agent session (not fully unauthenticated).

All signals point to a genuinely high-impact remote code execution flaw, tempered only by the niche footprint of the affected product. The vendor CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity attack requiring only low privileges (a connected gateway/agent) and no user interaction, yielding full confidentiality, integrity and availability loss on the Windows host - consistent with the description's 'execute arbitrary commands ... without operator checks or user prompts.' My independent CVSS 3.1 assessment lands at 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), in agreement. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is not confirmed as actively exploited - no public exploit identified at time of analysis. However, the patch commit ships a precise regression test suite demonstrating the exact bypass payloads ('*.*', '*.exe', 'c*', etc.), which effectively serves as a reproduction recipe and lowers the bar to weaponization. The single most important limiting factor is PR:L: the caller must already hold a connected gateway/agent session to reach system.execApprovals.set. Note the input 'Information Disclosure' tag understates the true impact - this is arbitrary command execution (RCE), not mere info disclosure - and the 'Microsoft' vendor tag is incorrect (OpenClaw is an independent open-source project). Net: a real priority for anyone running this product, but the low real-world deployment footprint bounds aggregate risk.

An attacker who controls or has compromised a connected OpenClaw gateway/agent session (e.g., via prompt injection of the agent) calls system.execApprovals.set with a broad allow rule whose executable token is wildcarded, such as {"pattern":"*.*","action":"allow"}. The incomplete validator accepts the rule, after which the attacker invokes system.run to execute living-off-the-land binaries like mshta, rundll32, or certutil, achieving arbitrary command execution on the Windows host with no operator confirmation or user prompt. No public exploit is published, but the patch's regression tests enumerate working bypass patterns.