OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway
Summary
A remote code execution (RCE) vulnerability in the gateway-to-node invocation path allowed an authenticated gateway client to bypass node-host exec approvals by injecting internal control fields into node.invoke parameters.
Affected Component
- Gateway method:
node.invokefor node commandsystem.run - Node host runner: exec approval gating for
system.run
Impact
If an attacker can authenticate to a gateway (for example via a leaked/shared gateway token or a paired device token with operator.write), they could execute arbitrary commands on connected node hosts that support system.run. This can lead to full compromise of developer workstations, CI runners, and servers running the node host.
Technical Details
The gateway forwarded user-controlled params to node hosts without sanitizing internal approval fields. The node host treated params.approved === true and/or params.approvalDecision as sufficient to skip the approval workflow.
Fix
Patched in OpenClaw 2026.2.14.
- Commits:
318379cdb8d045da0009b0051bd0e712e5c65e2da7af646fdab124a7536998db6bd6ad567d2b06b0c1594627421f95b6bc4ad7c606657dc75b5ad0ce0af76f5f0e93540efbdf054895216c398692afcd
- Gateway strips untrusted approval control fields from
system.runuser input. - Gateway only re-attaches approval flags when
params.runIdreferences a validexec.approval.requestrecord and the request context matches. Approval IDs are bound to the requesting device identity (stable across reconnects), preventing replay by other clients. - Gateway forwards only an allowlisted set of
system.runparameters, preventing future control-field smuggling.
Mitigations
- Upgrade to
2026.2.14or later. - Restrict access to the gateway (do not expose it to untrusted networks/users).
- Rotate gateway credentials if you suspect token/password exposure.
- Disable remote command execution on nodes by blocking
system.runat the gateway (gateway.nodes.denyCommands) and/or by configuring node exec security todeny.
Credits
OpenClaw thanks @222n5 for reporting this issue.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Paczka npm | openclaw | < 2026.2.14 | 2026.2.14 |
Odnośniki
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58
- https://nvd.nist.gov/vuln/detail/CVE-2026-28466
- https://github.com/openclaw/openclaw/commit/0af76f5f0e93540efbdf054895216c398692afcd
- https://github.com/openclaw/openclaw/commit/318379cdb8d045da0009b0051bd0e712e5c65e2d
- https://github.com/openclaw/openclaw/commit/a7af646fdab124a7536998db6bd6ad567d2b06b0
- https://github.com/openclaw/openclaw/commit/c1594627421f95b6bc4ad7c606657dc75b5ad0ce
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-invoke-approval-bypass
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Słabość (CWE)
CWE-20, CWE-441, CWE-863- Platforma
- npm
- Paczka
openclaw- Ujawniono
- 02.03.2026
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-gv46-4xfq-jv58 - CC BY 4.0
Historia podatności: openclaw
Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 588
- Pierwsza → ostatnia
- 02.2026 07.2026
- Bez poprawki
- 9
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Krytyczna 20
- Wysoka 215
- Średnia 299
- Niska 54
Ujawnienia w latach
- 2026: 588
-
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.