A critical vulnerability in OpenClaw allows authenticated attackers with administrative access to the Gateway to execute arbitrary code within the Node.js process.

This flaw, identified as CWE-427, arises because the Gateway component fails to validate configured hook module paths before passing them to dynamic import functions. An attacker with high privileges, specifically those permitted to modify gateway configurations, can leverage this to load and execute unintended local modules.

The ability to execute arbitrary code on the Gateway server poses a severe risk to organizational infrastructure, potentially leading to a complete compromise of the affected Node.js process. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that could facilitate unauthorized data access, lateral movement, or the permanent disruption of business-critical services.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to apply the necessary path validation fixes.

Proactive Monitoring: Review administrative audit logs for any unauthorized or unusual changes to gateway configuration settings or unexpected hook module registration attempts.

Compensating Controls: Restrict access to the Gateway configuration interface to the absolute minimum number of authorized administrators to reduce the attack surface.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution, security teams must prioritize the deployment of the 2026.2.14 update across all production environments. Although the vulnerability requires authenticated access to exploit, the severity of the impact necessitates prompt remediation to prevent unauthorized system control and potential data exfiltration.