A vulnerability in OpenClaw version 2026.2.22-2 allows authenticated remote attackers to bypass security restrictions, posing a significant risk of unauthorized command execution.

This is an incorrect authorization flaw (CWE-863) within the tools.exec.safeBins validation logic. The application fails to properly validate GNU long-option abbreviations for the sort command, allowing an attacker with low-level privileges to bypass denied-flag checks and execute unauthorized operations.

The ability to bypass allowlist restrictions enables attackers to execute arbitrary sort commands, potentially leading to unauthorized data manipulation or further system compromise. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity, as it undermines the security boundary established by the software's command validation mechanisms.

Immediate Action: Update the OpenClaw package to version 2026.2.23 or later to resolve the validation logic flaw.

Proactive Monitoring: Review system and application access logs for unusual command-line arguments or unexpected usage of the sort utility that deviates from standard operational patterns.

Compensating Controls: Implement strict command-execution policies at the operating system level and ensure that only necessary binaries are available to user-level processes.

Public Exploit Available: No (exploit_available: unknown)

Given the high severity of this authorization bypass, administrators should prioritize updating to the fixed version 2026.2.23 immediately. Failure to patch leaves the environment vulnerable to command execution attacks that circumvent established security policies.