A critical authorization bypass vulnerability in OpenClaw allows authenticated users to circumvent security policies and access restricted system-level tools.

This flaw is an incorrect authorization issue (CWE-863) where the application fails to restrict native shell, process, and file tools when a lower-trust conversation is assigned to a Codex runtime. An authenticated user can trigger these tools regardless of the configured per-chat tool allowlist.

The ability to bypass security policies and execute native system commands poses a significant risk to the confidentiality, integrity, and availability of the host environment. With a CVSS score of 8.8, this high-severity vulnerability could allow an attacker to gain unauthorized control over the runtime host, potentially leading to data exfiltration or system compromise depending on the sandbox configuration.

Immediate Action: Upgrade the OpenClaw npm package to version 2026.8.1 or later to ensure proper enforcement of tool policies.

Proactive Monitoring: Review audit logs for unauthorized attempts to access or execute native system tools within the Codex runtime environment.

Compensating Controls: Implement strict sandbox restrictions on the host environment to limit the impact of potential command execution, and apply network-level egress filtering to prevent unauthorized data movement.

Public Exploit Available: No (unknown)

Given the potential for unauthorized system-level operations, organizations should prioritize the update to version 2026.8.1 immediately. Failure to address this authorization bypass leaves the infrastructure vulnerable to command and file manipulation that should otherwise be prohibited by the application policy.