OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway
Summary
A remote code execution (RCE) vulnerability in the gateway-to-node invocation path allowed an authenticated gateway client to bypass node-host exec approvals by injecting internal control fields into node.invoke parameters.
Affected Component
- Gateway method:
node.invokefor node commandsystem.run - Node host runner: exec approval gating for
system.run
Impact
If an attacker can authenticate to a gateway (for example via a leaked/shared gateway token or a paired device token with operator.write), they could execute arbitrary commands on connected node hosts that support system.run. This can lead to full compromise of developer workstations, CI runners, and servers running the node host.
Technical Details
The gateway forwarded user-controlled params to node hosts without sanitizing internal approval fields. The node host treated params.approved === true and/or params.approvalDecision as sufficient to skip the approval workflow.
Fix
Patched in OpenClaw 2026.2.14.
- Commits:
318379cdb8d045da0009b0051bd0e712e5c65e2da7af646fdab124a7536998db6bd6ad567d2b06b0c1594627421f95b6bc4ad7c606657dc75b5ad0ce0af76f5f0e93540efbdf054895216c398692afcd
- Gateway strips untrusted approval control fields from
system.runuser input. - Gateway only re-attaches approval flags when
params.runIdreferences a validexec.approval.requestrecord and the request context matches. Approval IDs are bound to the requesting device identity (stable across reconnects), preventing replay by other clients. - Gateway forwards only an allowlisted set of
system.runparameters, preventing future control-field smuggling.
Mitigations
- Upgrade to
2026.2.14or later. - Restrict access to the gateway (do not expose it to untrusted networks/users).
- Rotate gateway credentials if you suspect token/password exposure.
- Disable remote command execution on nodes by blocking
system.runat the gateway (gateway.nodes.denyCommands) and/or by configuring node exec security todeny.
Credits
OpenClaw thanks @222n5 for reporting this issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.14 | 2026.2.14 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58
- https://nvd.nist.gov/vuln/detail/CVE-2026-28466
- https://github.com/openclaw/openclaw/commit/0af76f5f0e93540efbdf054895216c398692afcd
- https://github.com/openclaw/openclaw/commit/318379cdb8d045da0009b0051bd0e712e5c65e2d
- https://github.com/openclaw/openclaw/commit/a7af646fdab124a7536998db6bd6ad567d2b06b0
- https://github.com/openclaw/openclaw/commit/c1594627421f95b6bc4ad7c606657dc75b5ad0ce
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-invoke-approval-bypass
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-20, CWE-441, CWE-863- Platform
- npm
- Package
openclaw- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-gv46-4xfq-jv58 - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 589
- First → latest
- 02.2026 10.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 300
- Low 54
Disclosures per year
- 2026: 589
-
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.