OpenClaw Windows Node EUVD-2026-90253

Requires an authenticated/authorized connected gateway or agent that can invoke the system.run capability but is intended to be constrained by the exec-approval policy (an allow/deny ruleset) - the bypass only matters where such a restrictive policy is configured to gate commands. The attacker then evades approval by embedding denied commands behind an allowed prefix using shell metacharacters that ExecShellWrapperParser (before 2026.7.1) mis-parses: pipe operators (|) and command-substitution/subexpression syntax ($(...), backticks on POSIX shells, @(...)/(...) subshells). Limiting factors: the attacker must already hold the PR:L gateway/agent role and the target must run OpenClaw Windows Node older than 2026.7.1; deployments with no exec-approval restrictions (everything already allowed) gain nothing from the bypass, and the impact is confined to Windows host targets.

This is a genuinely elevated-priority authorization bypass. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) indicates a network-reachable, low-complexity, low-privilege flaw with full confidentiality/integrity/availability impact and no user interaction - consistent with the description's outcome of arbitrary command execution on Windows hosts. The one real gate is PR:L: the attacker must already be a connected gateway or agent permitted to invoke system.run under the exec-approval policy, so this is a privilege-escalation/control-bypass by an authorized-but-restricted party rather than a fully anonymous internet attacker. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation - but the vulnerability is reported by VulnCheck with a detailed root-cause and a vendor patch, and the bypass technique (pipe operators and command substitution) is trivially reproducible for anyone who reads the advisory or diff. The patch commit is public and clearly reveals the parser gap, which materially lowers the barrier to weaponization even though no POC is catalogued. Net: real priority for anyone running OpenClaw Windows Node with a restrictive exec-approval policy, tempered by the niche deployment footprint and the PR:L prerequisite.

An attacker operating (or having compromised) a connected gateway/agent that is restricted by OpenClaw's exec-approval allowlist submits a system.run request such as allowed-cmd | Remove-Item -Recurse C:\data or echo $(Invoke-Expression <denied>). Because ExecShellWrapperParser does not split on pipes or extract command substitutions, only the benign allowed prefix is evaluated against policy, so the denied stage executes on the Windows host with the node's privileges. No public exploit is catalogued, but the vendor patch diff plainly documents the bypassable constructs, making reproduction straightforward.