Listen to this Post
How CVE-2026-53822 Works
This vulnerability resides in OpenClaw’s shell wrapper command execution flow, specifically within the `system.run` functionality that processes shell commands. The core issue is a Time-of-Check Time-of-Use (TOCTOU) race condition, classified as CWE-367.
In affected versions (prior to 2026.5.18), when a command request using a shell wrapper form is submitted, the system performs a security check—such as consulting an allowlist—on the resolved `argv` (argument vector) shape. If the command shape is approved, the system proceeds to execute it. However, the vulnerability allows an attacker to modify the `argv` between the approval check and the actual execution. This means the command that is eventually executed can be different from the one that was reviewed and approved.
The flaw stems from the system’s failure to bind the approval to the exact `argv` that will be used at runtime. An attacker can craft a request that initially presents a benign command for approval but then rebuilds the argument vector to include malicious or unapproved commands before execution. This is particularly dangerous in environments using allowlists, as it allows attackers to bypass these controls entirely.
This vulnerability can be exploited by an attacker with low privileges over the network, requiring no user interaction. The potential impact is severe, as it can lead to the execution of arbitrary, unapproved commands, compromising the confidentiality, integrity, and availability of the system. The issue affects all OpenClaw deployments running a version earlier than 2026.5.18.
The fix for this issue was implemented in version 2026.5.18, which now binds approvals directly to the exact `argv` that will be executed. As a general hardening measure, it is recommended to keep channel and tool allowlists narrow and to avoid sharing a single Gateway between mutually untrusted users.
DailyCVE Form:
Platform: OpenClaw
Version: < 2026.5.18
Vulnerability: TOCTOU Command Injection
Severity: High (CVSS 8.7)
Date: 2026-06-12
Prediction: 2026-05-18
What Undercode Say:
Analytics & Code:
Check OpenClaw version npm list openclaw Example of a vulnerable command request (conceptual) The 'argv' is approved, but then rebuilt before execution. Fix: Upgrade to version 2026.5.18 or later.
Exploit:
An attacker can exploit this by submitting a command that passes the allowlist check but then modifying the `argv` before execution. This could involve injecting malicious arguments or altering the command path to execute an unapproved script. The exploit leverages the discrepancy between the approved command shape and the one that is ultimately run.
Protection:
- Upgrade: Immediately upgrade OpenClaw to version 2026.5.18 or later.
- Disable Feature: If an upgrade is not possible, disable the shell wrapper feature when it is not needed.
- Narrow Allowlists: Keep channel and tool allowlists as narrow as possible.
- Avoid Untrusted Sharing: Do not share a single Gateway instance between mutually untrusted users.
Impact:
Successful exploitation allows an attacker to execute arbitrary, unapproved commands. This can lead to a full compromise of the system’s confidentiality, integrity, and availability. The attack can be performed remotely over a network with low privileges and no user interaction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
