OpenClaw Windows Node CVE-2026-101884

Exploitation requires that the attacker already hold gateway or agent access to an OpenClaw Windows Node running a version before 2026.7.1, which is why PR is not None. From that position the attacker uses the system.run tool, which normally restricts execution to an allowlist of tools (git, dotnet, java). The specific bypass: the ExecEnvSanitizer denylist fails to block the code-loading environment variables GIT_CONFIG_* (git config injection setting core.pager/core.sshCommand/alias.*), the git command hooks GIT_PAGER/GIT_EDITOR/GIT_SEQUENCE_EDITOR/GIT_EXTERNAL_DIFF, the .NET loaders DOTNET_STARTUP_HOOKS/DOTNET_ADDITIONAL_DEPS, and the JVM injectors JAVA_TOOL_OPTIONS/_JAVA_OPTIONS/JDK_JAVA_OPTIONS. Code execution only actually occurs when one of those allowlisted tools is subsequently invoked in the poisoned environment (the AT:P attack requirement). Limiting factors: it is not remote-unauthenticated (requires gateway/agent access), it is Windows-only, and it requires that at least one of git/dotnet/java be present and reachable through system.run.

This is a genuine high-severity issue but not a top-tier emergency, driven mostly by the RCE technical impact rather than by ease of reach. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, 7.7) tells a consistent story: network-facing, low complexity, but requiring some privilege (PR:L - the attacker must already have gateway or agent access to the node) and an attack requirement (AT:P) reflecting that code execution only fires when an allowlisted tool (git/dotnet/java) is actually invoked in the poisoned environment. All three impacts are HIGH because the payload achieves arbitrary code execution with the node process's privileges. There is NO EPSS score, NO CISA KEV listing, and NO public exploit - status is 'no public exploit identified at time of analysis.' The absence of exploitation signals combined with the PR:L gate means this is a defense-in-depth / post-compromise-escalation issue rather than a mass-exploitable internet vulnerability: an attacker who already has gateway or agent control (e.g., via prompt injection of the agent) uses it to break out of the system.run command-allowlist sandbox. The root cause is well-confirmed by the vendor patch diff (CWE-184 incomplete denylist). Note the CWE mismatch to verify: NVD/tags imply straightforward RCE but the technical class is an incomplete-blocklist bypass, meaning it chains onto whatever grants gateway/agent access.

An attacker who has gained gateway or agent access to an OpenClaw Windows Node - for example by prompt-injecting the connected agent - cannot run arbitrary commands directly because system.run enforces a command allowlist. Instead they set environment variables the sanitizer fails to strip (e.g. GIT_CONFIG_COUNT/KEY/VALUE pointing core.sshCommand at a payload, DOTNET_STARTUP_HOOKS to an attacker assembly, or JAVA_TOOL_OPTIONS='-javaagent:evil.jar') and then invoke an allowlisted tool like git, dotnet, or java. The tool loads the attacker-controlled code and executes it with the node's privileges, even though the command string itself never changed. No public PoC exists, but the vendor patch and regression tests fully document the technique.