OpenClaw node host system.run rawCommand/command mismatch allows allowlist bypass
OpenClaw's node host system.run handler contained a mismatch between the rawCommand parameter used for allowlist checks and the command[] array used for actual execution. This enabled attackers with system.run access to bypass security controls by providing an approved command name while executing a different command through the argv parameter.
What happened
A mismatch between rawCommand and command[] in the OpenClaw node host system.run handler could cause allowlist and approval evaluation to be performed on one command while executing a different argv.
An attacker with the ability to invoke system.run could bypass allowlist enforcement and approval prompts by supplying an allowlisted rawCommand while providing a different command[] argv for execution.
The vulnerability affected deployments using the node host execution path with allowlist-based exec policy and approval prompting enabled.
Reported impact
Attackers could execute commands that should have been blocked or required user approval by exploiting the inconsistency between the allowlist-checked command and the actual executed command.
Index analysis
The flaw was a validation gap where the system checked permissions against one command string but executed a different command specified in an array parameter.
Governance controls
OpenClaw published a patch in version 2026.2.14 that enforces rawCommand and command[] consistency through gateway fail-fast validation and node host validation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.